EUVD-2026-76741

Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. An attacker positioned on the network path between the proxy and the identity provider could impersonate the...

Blitz Identity Provider (Authentication server)

...

EUVD-2026-42966

ZITADEL: Auto-linking by email: IdP-side email verification is not checked...

CVE-2026-90452

CVE-2026-90452 affects a reverse proxy component where requests to an identity-provider service (for token discovery, introspection, and credential exchange) do not verify the IdP's server certificate . An attacker positioned on the network path between the proxy and the identity provider could i...

authentik

什么是 authentik？ authentik 是一个面向现代单点登录（SSO）的开源身份提供者（IdP）。它支持 SAML、OAuth2/OIDC、LDAP、RADIUS 等协议，专为自托管而设计，从小型实验室到大型生产集群均适用。 我们的企业版产品可供组织使用，以安全地替代 Okta、Auth0、Entra ID 和 Ping Identity 等现有 IdP，实现稳健的大规模身份管理。 安装 Docker Compose：推荐用于小型/测试环境。请参阅文档。 Kubernetes（Helm Chart）：推荐用于较大型环境。请参阅文档和 Helm chart 的仓库。 AWS...

flask-saml2

flask-saml2 .. note:: 寻找维护者 。本项目已不再维护。该库在我上次使用时仍可正常工作， 但我已不再参与当初为其构建的项目。如果您有兴趣接管并维护此项目，请与我们联系。 .. image:: https://travis-ci.com/timheap/flask-saml2.svg?branch=master :target: https://travis-ci.com/timheap/flask-saml2 .. image:: https://badge.fury.io/py/flask-saml2.svg :target:...

shimit

shimit shimit is a python tool that implements the Golden SAML attack. More informations on this can be found in the following article on our blog. root@kitploit: python .\shimit.py -h usage: shimit.py -h -pk KEY -c CERT -sp SP -idp IDP -u USER -reg REGION --SessionValidity SESSIONVALIDITY...

Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

CVE-2026-3055

🔥 NetScalerBleed2：Citrix NetScaler 中的严重未授权内存过度读取 CVE-2026-3055 未授权越界内存读取（内存泄漏） 仅适用于配置为 SAML 身份提供程序 IdP 的设备 📋 概述 CVE-2026-3055 是 Citrix NetScaler ADC 和 NetScaler Gateway 中的一个严重 越界读取漏洞（CWE-125）。 该漏洞由 SAML 处理过程中输入验证不足 导致。未授权 远程攻击者可触发内存过度读取，泄露设备内存中的敏感数据——包括活动的会话令牌 、凭据或其他机密（在特定条件下）。...

DRUPAL-CONTRIB-2026-151

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently validate URLs obtained from identity provider metadata. An attacker with the ability to configure identity...

DRUPAL-CONTRIB-2026-145

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly restrict which signature algorithm may be used to validate a SAML assertion, allowing the algorithm to be influenc...

CVE-2023-34362

CVE-2023-34362 影响 MOVEit Transfer 的 CVE-2023-34362 POC 技术分析 该漏洞的技术根因分析可在以下博客中找到： 摘要 此 POC 利用 SQL 注入获取 sysadmin API 访问令牌，然后利用该访问权限滥用反序列化调用来实现远程代码执行。 此 POC 需要连接到一个托管了正确 RS256 证书的 Identity Provider 端点，这些证书用于伪造任意用户令牌——默认情况下，此 POC 使用我们在 AWS 上托管的 IDP 端点。 该漏洞利用程序默认会在 C:\Windows\Temp\message.txt...

check-cve-2026-3055-netscaler

CVE-2026-3055 NetScaler SAML IdP 检测 用于探测 Citrix NetScaler / NetScaler Gateway 设备是否存在 CVE-2026-3055（充当 SAML 身份提供方 时的内存越界读取）的 Python 辅助工具。检测逻辑与 watchTowr Labs 的公开文章一致。 前置条件 Python 3.10+ 仅适用于配置为 SAML IdP 的设备。未承担该角色的网关通常在 /saml/login 上返回 404；这意味着不适用 于该 CVE，而非“对所有 NetScaler 问题都安全”。 安装 root@kitploit: c...

CVE-2026-86084

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an...

CVE-2026-86084 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an...

CVE-2026-86084

n8n is an open-source workflow automation platform. Prior to versions 1.123.76 , 2.37.7 , and 2.38.2 , the public OIDC login and callback endpoints could complete authentication and issue valid sessions even when OIDC was not the active authentication method. The root cause lies in packages/cli/s...

CVE-2026-62916 Microsoft Entra ID Elevation of Privilege Vulnerability

...

CVE-2026-62916 Microsoft Entra ID Elevation of Privilege Vulnerability

...

CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-84668

Jenkins SAML Plugin 4.618.v441a27fa46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data binding, allowing attackers to replace it with attacker-controlled content and authenticate as any user...