CVE-2022-23131

zabbix-saml-bypass-poc cve-2022-23131 Данная программа предназначена только для внутренней проверки рисков сотрудниками организаций-заказчиков. Запрещено использование для любого вида несанкционированного тестирования безопасности. root@kitploit: fofa: app="ZABBIX-监控系统" && body="saml"...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Apache Airflow의 AWS Auth Manager에서 호스트 헤더 인젝션으로 인한 SAML 인증 우회 공격자는 SAML 로그인 흐름에 악의적인 Host 헤더를 주입하여 Assertion Consumer Service ACS URL이 공격자가 제어하는 서버를 가리키도록 할 수 있습니다. 이를 통해 공격자는 유효한 SAML 응답을 캡처 하고 이를 재전송하여 피해자 Airflow 인스턴스에 무단 액세스 를 얻거나, 액세스 제어가 다른 여러 Airflow 인스턴스 간에 토큰을 재사용할 수...

zabbix-cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. замените zbxsignedsession на cookie 2. войдите с помощью единого входа SAML автор: @random-robbie、@jweny и @Mr-xn ссылка: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

cve-2022-23131

cve-2022-23131 cve-2022-23131 zabbix-saml-bypass-exp 1. замените zbxsignedsession на cookie 2. войдите с помощью единого входа SAML автор: @random-robbie、@jweny и @Mr-xn ссылка: https://blog.sonarsource.com/zabbix-case-study-of-unsafe-session-storage...

My-Presentation-Slides

My-Presentation-Slides Collections of Dhiyaneshwaran public presentation slides. You can find me at: Blog: https://dhiyaneshgeek.github.io Twitter: @DhiyaneshDk Hackerone: Geek Freak LinkedIn: Dhiyaneshwaran Balasubramaniam 2026 Hands-On Supply Chain Recon & Vendor Risk Mapping Recon Village @ DE...

CVE-2022-26138

CVE-2022-26138 CVE-2022-23131 - обход SAML SSO root@kitploit: fofa: iconhash="-305179312"...

CVE-2025-23369_SAML_bypass

bypass github...

EUVD-2026-72177

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parseassertion builds Net::SAML2::Binding::POST without a trust anchor. parseassertion in MojoX::Authentication::Model::SAML2 calls Net::SAML2::Binding::POST-new with no cacert, certtext or anchors...

CVE-2026-86304

MojoX::Authentication versions before 0.006 for Perl contain a SAML authentication bypass in parse_assertion (MojoX::Authentication::Model::SAML2). The method calls Net::SAML2::Binding::POST->new without any trust anchor (cacert, cert_text, or anchors), then passes the result to Net::SAML2::Pr...

PT-2026-86577

Name of the Vulnerable Software and Affected Versions MojoX::Authentication versions prior to 0.006 Description An authentication bypass exists in the SAML implementation. The parse assertion function in MojoX::Authentication::Model::SAML2 initializes Net::SAML2::Binding::POST without a trust...

CVE-2026-7557 SAML authentication bypass in Progress MarkLogic Server

An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affec...

CVE-2026-18089

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verifyxml when no trust anchor is configured. verifyxml in Net::SAML2::Role::VerifyXML runs "return if !$anchors && !$cacert;" as soon as the XML::Sig chec...

Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances.You shoul...

PYSEC-2026-2363 Apache Airflow AWS Auth Manager has Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

CVE-2026-25604

CVE-2026-25604 affects Apache Airflow with the AWS Auth Manager: the code uses the client-supplied Host header to build the SAML ACS URL, bypassing validation against the configured instance URL. This enables potential cross-instance SAML token reuse and unauthorized access if a malicious Host he...

CVE-2026-25604 Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass

In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL. This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You...

MiracleLinux 9 : open-vm-tools-12.3.5-2.el9 (AXBA:2024-8096:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXBA:2024-8096:03 advisory. - VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges...

Critical vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 exploited in the wild

Overview Update for CVE-2026-24858: On January 27, 2026, Fortinet disclosedCVE-2026-24858 , a critical unauthenticated vulnerability allowing authentication bypass via Fortinet’s cloud SSO. Confirmed as a net-new vulnerability rather than a patch bypass, it has beenobserved under active zero-day...

Linux Distros Unpatched Vulnerability : CVE-2023-34058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges...

Incorrect context paths included in the fallback URL still pass you to the login form when enable-authentication-fallback is enabled.

h3. Issue Summary When using an incorrect fallback URL to bypass SAML, you are still passed to the login form. This can be reproduced using a context path in the URL when no context path is set in the server.xml or by using a misspelled/wrong context path when one is set. This is reproducible on...