RHACS Central EUVD-2026-104252

Exploitation requires that RHACS Central be configured to use SAML authentication (the Central SAML ACS endpoint must be in use) AND that the attacker first obtain a valid, unexpired, signed SAML response for a mapped identity - the vulnerability is the absence of assertion/response ID replay tracking on that endpoint. Limiting factors: the attacker cannot forge the response (it must be legitimately signed), the response must still be within its validity window (unexpired), and a SAML/SSO integration must be deployed - deployments using non-SAML authentication are unaffected. These prerequisites account for the HIGH attack complexity (AC:H) despite no privileges or user interaction being needed.

This is a moderate-to-serious authentication weakness (CWE-294, Authentication Bypass by Capture-replay) rated CVSS 7.4. The provided CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates a network-reachable flaw requiring no privileges and no user interaction, but with HIGH attack complexity - the critical mitigating factor. The complexity is HIGH precisely because the attacker must first obtain a valid, unexpired, signed SAML response, which is a non-trivial precondition requiring a position to capture or intercept that assertion. No EPSS score, CISA KEV listing, or public POC was supplied in the intelligence, so exploitation probability signals are entirely absent - the exploitation status is therefore 'no public exploit identified at time of analysis.' There is a notable data conflict: the input Tags label this 'Denial Of Service,' yet the CVSS vector explicitly sets A:N (no availability impact) and the description describes token minting via replay - this is an authentication/confidentiality-integrity issue, not a DoS, so the tag is mislabeled and should be disregarded. Net assessment: a credible but conditional risk that depends heavily on an attacker already having access to a signed SAML response; it is a real priority for organizations using SAML SSO with RHACS Central, but the HIGH complexity and lack of any exploitation signals place it below drop-everything urgency.

An attacker positioned to capture network traffic or who otherwise obtains a valid, unexpired signed SAML response (for example via a logging sink, proxy, or browser-side capture) replays that same response to the RHACS Central SAML ACS endpoint multiple times. Because Central does not track used assertion or response identifiers, each submission yields a fresh, distinct authentication token for the mapped identity, letting the attacker establish or extend authenticated sessions as that user. No public exploit code is identified at time of analysis, and success depends on first acquiring the signed response (reflected in the HIGH attack complexity).