What is the CVSS score of CVE-2026-15556?

CVE-2026-15556 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of PicketLink are affected by CVE-2026-15556?

PicketLink Service Provider deployments face a high-severity authentication control failure (CVE-2026-15556, CVSS 8.1) that allows attackers with network access to bypass SAML authentication and…. A patch is available.

How to fix or mitigate CVE-2026-15556?

Within 24 hours: inventory all applications using PicketLink Service Provider in production and development environments; identify which versions are deployed; restrict network-level access to affected SAML Service Providers pending remediation. Within 7 days: implement enhanced SAML response validation requiring strict signature verification on non-empty assertion elements; enable comprehensive audit logging of all SAML authentication attempts; enforce multi-factor authentication on all high-value systems or applications processing sensitive data. Within 30 days: actively monitor PicketLink security advisories for vendor-supplied patches and apply immediately upon release; alternatively, initiate migration to alternative SAML implementations if patches are delayed; or ensure all interim compensating controls are operational organization-wide if patching is not feasible.

PicketLink CVE-2026-15556

EUVD-2026-55983 HIGH

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-11 secalert@redhat.com

GHSA-vw9v-mpfh-qwg3

Denial Of Service Jwt Attack

8.1

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network delivery via SAML ACS endpoint; PR:L reflects attacker must initiate a SAML flow; no availability impact as the attack is authentication forgery only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

8.1 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:33 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

HIGH 8.1

DescriptionCVE.org

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

AnalysisAI

SAML authentication bypass in PicketLink's Service Provider signature validation allows a network-accessible attacker with low privileges to forge a SAML response and authenticate as any principal with any role on the protected application. The flaw, rooted in CWE-347 (Improper Verification of Cryptographic Signature), arises because the signature check vacuously passes when the SAML response contains zero matching assertion elements, giving the attacker full control over identity and role claims presented to the SP. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact on confidentiality and integrity make this a critical authentication control failure.

Technical ContextAI

PicketLink is Red Hat's federated identity management framework, commonly deployed as the SAML 2.0 Service Provider (SP) layer in JBoss EAP and WildFly application server environments. The vulnerability resides in the SP-side SAML response processing logic, specifically in how assertion elements are iterated during cryptographic signature verification. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause: when the response contains zero assertion elements, the validation loop has nothing to evaluate and exits as if all checks passed, effectively treating an empty assertion set as valid. This class of flaw is closely related to XML Signature Wrapping (XSW) attacks, where signature-to-element binding is broken by manipulating document structure. The 'Jwt Attack' tag in the source data likely reflects a misclassification or tooling artifact, as PicketLink processes SAML assertions rather than JSON Web Tokens; the DoS tag similarly does not align with the described impact.

RemediationAI

Consult the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-15556 for the official patch and affected version list, as no specific fixed version was included in the provided intelligence. The Bugzilla entry at https://bugzilla.redhat.com/show_bug.cgi?id=2483121 may include patch commits or errata links. While awaiting a patch, consider enforcing strict schema validation on inbound SAML responses to reject documents containing zero assertion elements - most SP middleware allows pre-processing hooks or filter chains where this check can be inserted. Additionally, restricting which Identity Providers are trusted at the network layer (allowlisting IdP endpoints and enforcing mTLS on SAML back-channel communication) reduces the surface for crafted response injection. Note that schema-level filtering may break edge cases in legitimate multi-assertion flows and should be tested in staging before production deployment.