EUVD-2026-55983

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application...

CVE-2026-9093: Undefined Security Weakness

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestriction element in SAML assertions. The buildSp function in object/samlsp.go never sets AudienceURI on the gosaml2 SAMLServiceProvider struct and never inspects...

EUVD-2008-7252

Malware in sbrugna...

PT-2011-1291

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager TFIM version 6.2.0 Description The issue is related to an incomplete SAML 1.x browser-artifact in IBM Tivoli Federated Identity Manager TFIM, which allows remote OpenID providers to spoof assertions. This ...