EUVD-2026-55980
GHSA-wcq4-9xxp-5px6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing SSO endpoint, no auth or interaction, and trivially forged assertions justify AV:N/AC:L/PR:N/UI:N; full identity spoofing gives C:H/I:H/A:H, scope unchanged.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
AnalysisAI
Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses PicketLink for SAML SSO and has the unsolicited (IdP-initiated) SAML response flow enabled/reachable - the description explicitly scopes the flaw to the 'unsolicited response handler,' which is the concrete precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) is internally consistent with the description: a network-facing SSO endpoint, no authentication and no user interaction required, low complexity because forging and POSTing a SAML assertion needs no special timing or race, and complete compromise of confidentiality, integrity, and availability through full identity spoofing. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the primary action is to consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-10579) and Bugzilla 2480325 (https://bugzilla.redhat.com/show_bug.cgi?id=2480325) for the fixed build and apply it once published; do not deploy a version number that is not confirmed by Red Hat. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all systems running Red Hat PicketLink Federation SAML implementation and assess blast radius across federated applications; contact Red Hat support for CVE-2026-10579 patch timeline and subscribe to security advisories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today