CVE-2020-5268

In Saml2 Authentication Services for ASP.NET, versions before 1.0.2 and between 2.0.0 and 2.6.0 contain a vulnerability in token validation. Sustainsys.Saml2 incorrectly treats all incoming tokens as bearer tokens, despite tokens being subject-confirmed by other means (e.g., holder-of-key). An at...

CVE-2020-5261

The CVE concerns Sustainsys.Saml2 (ASP.NET, NuGet) versions greater than 2.0.0 and less than 2.5.0, which have a faulty Token Replay Detection implementation. Token Replay Detection is cited as a defense in depth for SSO; the 2.5.0 release is patched, while 1.0.1 and earlier are reported as safe....

CVE-2023-41890

Sustainsys.Saml2 (used to add SAML2P to ASP.NET sites) contains CVE-2023-41890 due to insufficient validation of the IdP issuer when processing a response. This can let a malicious IdP craft a SAML2 response that appears to come from another IdP, and an end user could cause stored AuthenticationP...