EUVD-2026-57253
GHSA-c4qm-8pgx-8w9v
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:N for web-based SAML endpoint; AC:H for the prerequisite of obtaining a valid SAML assertion; PR:L since the attacker must hold some authenticated IdP identity; full C/I/A impact from arbitrary user impersonation.
Primary rating from Vendor (JFROG).
CVSS VectorVendor: JFROG
Lifecycle Timeline
3DescriptionCVE.org
A user with access to a valid SAML response may impersonate another user under specific conditions.
AnalysisAI
SAML response impersonation in JFrog Artifactory (all tracked versions per CPE) permits an attacker who possesses a valid SAML response to assume the identity of another user under specific conditions. Rooted in CWE-347 (Improper Verification of Cryptographic Signature), the flaw indicates Artifactory fails to adequately validate SAML assertion signatures or cryptographic bindings - a class of weakness commonly exploited via XML Signature Wrapping (XSW) or assertion replay attacks. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires SAML SSO to be configured and enabled in the Artifactory instance - deployments using only local or LDAP authentication are not affected. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 7.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the JFrog security advisory at https://docs.jfrog.com/releases/docs/jfrog-security-advisories and the Artifactory self-managed release notes at https://docs.jfrog.com/releases/docs/artifactory-self-managed-releases for the specific patched version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all JFrog Artifactory instances using SAML authentication and cross-reference versions against the vulnerable CPE list; conduct immediate review of authentication logs for suspicious identity transitions or unauthorized administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today