ROOST Coop CVE-2026-63398

Two concrete prerequisites, both stated by the vendor: (1) the attacker must be an administrator of at least one organization on the same Coop instance, which is required to register a SAML IdP; and (2) the target organization must have registered a SAML signing certificate that matches a signing key the attacker controls. With both met, the attacker POSTs a SAML assertion for the victim's email to the target org's /saml/login/:orgId/callback path and the pre-1.0.2 email-only lookup resolves the victim. The decisive LIMITING factor is condition (2): organizations normally do not share both an IdP and its signing certificate, so this is exploitable only in that unusual shared-certificate configuration. Affects versions < 1.0.2; updating to 1.0.2 (which binds the lookup to the callback-path orgId) is the fix.

Signals point to a genuine but tightly scoped flaw rather than a broad emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:H/UI:N, VC:H/VI:H) scores 7.4 High, but two metrics heavily temper it: PR:H (the attacker must already be an administrator of some organization on the same Coop instance in order to register a SAML IdP) and AT:P (a specific attack requirement - the target org must have registered a signing certificate matching a key the attacker controls). The vendor advisory explicitly states orgs 'in most cases will not share an IdP and certificate,' so the preconditions are unusual. The Decision label is 'this_week' (not act_now/emergency), it is NOT listed in CISA KEV, and no EPSS score was provided in the input. Exploitation status: no public exploit identified at time of analysis - the references are the GHSA advisory, fix PR #783, the fix commit, and the 1.0.2 release tag, none of which is a working exploit. Bottom line: when exploitable it yields full cross-tenant account takeover (high technical impact), but the shared-certificate prerequisite makes widespread opportunistic exploitation unlikely; treat as a prompt-but-not-panic patch, consistent with the 'this_week' priority. No conflicting signals were detected in the supplied data; EPSS and POC data are simply absent.

An attacker who administers Organization A on a shared Coop deployment registers a SAML IdP using a signing key they control. If Organization B has registered the same signing certificate, the attacker signs a SAML assertion asserting a victim's email (belonging to Org B) and POSTs it to Org B's /saml/login/:orgId/callback endpoint. Because the pre-1.0.2 verify callback resolved the user by email alone, the assertion validates against Org B's certificate and a session is minted as the Org B victim. No public exploit code is identified at time of analysis.