EUVD-2026-53424
GHSA-j86w-xf2g-5g65
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable pre-auth SAML signature bypass enabling admin impersonation gives AV:N/AC:L/PR:N/UI:N with high confidentiality and integrity but no availability impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
An improper verification of cryptographic signature vulnerability in the SAML authentication module of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an unauthenticated remote attacker to bypass authentication and impersonate any user, including administrators. This vulnerability affects deployments with SAML single sign-on enabled.
AnalysisAI
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote attacker forge SAML assertions and impersonate any user, including administrators, on deployments where SAML single sign-on is enabled. The flaw stems from improper cryptographic signature verification (CWE-347) in the SAML authentication module, yielding full identity spoofing over the network with low complexity and no user interaction. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target MarkLogic Server deployment to have SAML single sign-on explicitly enabled and its SAML SSO endpoint reachable by the attacker - this configuration is the exact prerequisite named in the vendor description ('affects deployments with SAML single sign-on enabled'). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, pre-authentication attack with high confidentiality and integrity impact and no availability impact - consistent with an authentication bypass rather than a crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach a SAML-enabled MarkLogic App Server crafts a SAML response/assertion naming a privileged account (e.g., an admin) and, because the signature is not properly verified, submits it to the SSO endpoint. MarkLogic accepts the forged assertion and grants an authenticated session as that user, giving the attacker administrative control over the database. … |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 or later on the 11.x branch, or 12.0.3 or later on the 12.x branch, per the Progress advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Disable SAML SSO on all Progress MarkLogic deployments that cannot be immediately updated, reverting to alternative authentication mechanisms or restricting network access to administrative consoles if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today