7307 matches found
authentik
What is authentik? authentik is an open-source Identity Provider IdP for modern SSO. It supports SAML, OAuth2/OIDC, LDAP, RADIUS, and more, designed for self-hosting from small labs to large production clusters. Our enterprise offering is available for organizations to securely replace existing...
CLEANSTART-2026-ZK87180 application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2
Security vulnerability affects the apache-nifi package. An application using spring-security-saml2-service-provider and the REDIRECT binding for SAML 2...
CLEANSTART-2026-FU03579 Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payl...
Security vulnerability affects the apache-nifi package. Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a...
CVE-2026-97791
A flaw was found in Apache CXF. This vulnerability allows an authentication bypass when validating Security Assertion Markup Language SAML tokens. Because the token validator shares validation state across concurrent requests, a remote, unauthenticated attacker can submit a forged assertion signe...
Denial of Service (DoS)
Overview org.apache.cxf:cxf-core is an an open source services framework. CXF helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS. Affected versions of this package are vulnerable to Denial of Service DoS via the CompressionUtils.inflate function. An...
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-78384
CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...
BIT-APISIX-2026-94212 Apache APISIX: unauthenticated impersonation issue in saml-auth
Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every route protected by the saml-auth plugin under default configuration. This issue affects Apache APISIX: from 3.17.0 through 3.18.0. Users are recommende...
CVE-2026-97791
A flaw in Apache CXF 's STSTokenValidator allows for an authentication bypass during SAML token validation. The vulnerability stems from a race condition (CWE-362) where the validator shares a single object to store validation results across concurrent requests. This allows a remote, unauthentica...
CVE-2026-97791
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-97791 Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
EUVD-2026-95700
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
CVE-2026-78384 Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...
EUVD-2026-95696
CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...
CVE-2026-78384
A vulnerability exists in Apache CXF (specifically the org.apache.cxf:cxf-core component) where the CompressionUtils.inflate() function fails to enforce an output-size cap when decompressing DEFLATE data. A remote attacker can exploit this by submitting a small, crafted payload that expands into ...
Vulnerability handling in Citrix NetScaler ADC and Gateway
Citrix has identified a vulnerability in NetScaler ADC and Gateway products when these are configured as SAML Service Providers SPs or Identity Providers IdPs. The vulnerability involves a memory overflow that occurs during the processing of SAML messages. This vulnerability can be activated...
EUVD-2026-95315
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements: For the following versions: Applicable only...
CVE-2026-97791: Concurrent Execution using Shared Resource with Improper Synchronization
In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. That result was stored in one object shared by all requests, so one request could read another's result. A remote, unauthenticated attacker could send a forge...
PT-2026-108867
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.4 Apache CXF versions prior to 4.1.9 Apache CXF versions prior to 3.6.13 Description An issue exists in the STSTokenValidator where the result of the SAML assertion signature check is stored in an object shared...
CVE-2026-78384: Improper Handling of Highly Compressed Data (Data Amplification)
CompressionUtils.inflate decompressed attacker-controlled DEFLATE data with no output-size cap. A small KB crafted payload could expand to gigabytes on the heap. Reachable via JWE decryption when zip=DEF e.g. JoseSessionTokenProvider with RSA-OAEP key wrap and via SAML redirect/POST binding token...