Authentication Bypass by Alternate Name

Overview Sustainsys.Saml2 is a SAML2 protocol support. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name due to improper validation in the AcsCommandResultCreated function. An attacker can craft a SAML2 response that is processed as if issued by another...

CVE-2023-41890

Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service Provider. Prior to versions 1.0.3 and 2.9.2, when a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity...