EUVD-2026-102474

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrar...

NetScaler ADC and NetScaler Gateway Memory Overflow (CTX697191 / CVE-2026-107406)

The remote NetScaler ADC formerly Citrix ADC or NetScaler Gateway formerly Citrix Gateway device is 13.1 prior to 13.1-64.29, or 14.1 prior or equal to 14.1-73.41, or 13.1-FIPS/NDcPP prior to 13.1-37.283, or 14.1-FIPS prior or equal to 14.1-73.41 FIPS. It is, therefore, affected by a vulnerabilit...

CVE-2026-3055

🔥 NetScalerBleed2: Critical Unauth Memory Overread in Citrix NetScaler CVE-2026-3055 Unauthenticated Out-of-Bounds Memory Read Memory Leak Only on appliances configured as SAML Identity Provider IdP 📋 Overview CVE-2026-3055 is a critical out-of-bounds read vulnerability CWE-125 in Citrix NetScale...

CVE-2026-111283

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...

CVE-2026-111283

BMC Helix Network Management on-prem versions before 26.3.01 are vulnerable to an authentication bypass when SAML single sign-on is configured. This flaw allows unauthenticated attackers to gain a SuperAdmin session by submitting the local administrator username with an arbitrary password on the ...

CVE-2026-111283 BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...

CVE-2026-111283 BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...

CVE-2026-25604-PoC

CVE-2026-25604 PoC Host Header Injection leading to SAML authentication bypass in Apache Airflow's AWS Auth Manager An attacker can inject a malicious Host header into the SAML login flow, causing the Assertion Consumer Service ACS URL to point to an attacker-controlled server. This allows the...

CVE-2026-19490-check

Citrix NetScaler SAML nFactor Context Authentication Bypass — Vulnerability Detection Script A safe, unauthenticated vulnerability check for CVE-2026-19490 , the pre-authentication authentication bypass in the Citrix NetScaler ADC / NetScaler Gateway SAML service-provider path CTX696939, publishe...

CVE-2026-19490

CVE-2026-19490 — NetScaler ADC/Gateway SAML authentication bypass Unauthenticated session forgery on Citrix NetScaler ADC / NetScaler Gateway via the SAML HTTP-Redirect binding handler at GET /cgi/samlauth. CVSS 4.0 9.3, CWE-288. Bulletin CTX696939 2026-08-19, no workarounds. Credit for the...

CVE-2025-29775

SAMLStorm CVE-2025-29775 Lab Environment This is a lab environment for demonstrating the SAMLStorm vulnerability CVE-2025-29775 that affects the xml-crypto library and SAML implementations in Node.js. Note: This is not a true exploitation of the vulnerability, just a recreation to demonstrate how...

cve-2022-23131

cve-2022-23131 FOFA app="ZABBIX-监控系统" && body="saml" Run python cve-2022-23131.py https://www.example.com Admin Use the exp to generate signedsession, replace the cookie, then click Sign in with Single Sign-On SAML Default is Admin Act responsibly, you bear the consequences A chance encounter, a...

CVE-2021-21239

Technical Report on CVE-2021-21239: Redash SAML Authentication Vulnerability Introduction to SAML Security Assertion Markup Language SAML is an open standard for exchanging authentication and authorization data between parties in a federated identity system. It enables single sign-on SSO across...

CVE-2025-59718-PoC

CVE-2025-59718 Exploit Wizard Overview This tool is a proof-of-concept PoC exploit script for CVE-2025-59718, a critical authentication bypass vulnerability in Fortinet products e.g., FortiOS, FortiProxy, FortiSwitchManager due to improper verification of cryptographic signatures in SAML messages...

CVE-2022-4361

CVE-2022-4361 Description This repository contains a PoC for CVE-2022-4361. All the credits go to original author of the discovery, mulliken; IMPORTANT : this PoC is not complete as it does not cover the case for the AssertionConsumerServiceURL value on the SAML authentication protocol. Currently...

CVE-2026-60206-PoC-Exploit

CVE-2026-60206 - Oracle WebLogic SAML Auth Bypass Exploit Framework-Toolkit Oracle WebLogic Server — SAML Authentication Bypass → Admin Takeover Exploit Framework & Mass Scanner For authorized security testing only. ⚖️ Legal Disclaimer & Responsible Use This tool is provided for educational and...

fusionauth-samlv2

fusionauth-samlv2 This repository is SAML v2.0 bindings in Java using JAXB. You'd use this library to process SAML requests and responses. See the tests for example code. Security disclosures If you find a vulnerability or other security related bug, please report the vulnerability here before...

CVE-2026-9090-poc

CVE-2026-9090 — Casdoor SAML Signature Bypass PoC Proof-of-concept for CVE-2026-9090 CWE-347, Improper Verification of Cryptographic Signature, an authentication bypass in the Casdoor identity platform. Attribution. CVE-2026-9090 was published and coordinated by CERT/CC — see VU780781. This...

Zabbix - SAML SSO Authentication Bypass

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...

Ivanti Connect Secure - XXE

Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. id: CVE-2024-22024 info: name: Ivanti Connect Secure - XXE author: watchTowr severity: high description: | Ivanti Connect Secure is vulnerable to XXE XML External Entity injection. impact: | Successful exploitation of this...