What is the CVSS score of EUVD-2026-55980?

EUVD-2026-55980 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PicketLink are affected by EUVD-2026-55980?

Red Hat PicketLink Federation contains a critical SAML authentication bypass allowing unauthenticated remote attackers to impersonate any user, compromising federated identity and enabling…. A patch is available.

How to fix or mitigate EUVD-2026-55980?

Within 24 hours: audit all systems running Red Hat PicketLink Federation SAML implementation and assess blast radius across federated applications; contact Red Hat support for CVE-2026-10579 patch timeline and subscribe to security advisories. Within 7 days: deploy emergency mitigations including disabling IdP-initiated SAML response handling and enforcing mandatory SAML assertion signature validation at application entry points; implement real-time monitoring and alerting for malformed or unsigned SAML assertions. Within 30 days: obtain and deploy patched version of Red Hat PicketLink upon vendor release; conduct forensic analysis of SAML transaction logs for evidence of exploitation or unauthorized impersonation; perform identity risk assessment across all systems that depend on PicketLink-mediated authentication.

PicketLink EUVD-2026-55980

| CVE-2026-10579 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-11 secalert@redhat.com

GHSA-wcq4-9xxp-5px6

Information Disclosure Jwt Attack

9.8

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-facing SSO endpoint, no auth or interaction, and trivially forged assertions justify AV:N/AC:L/PR:N/UI:N; full identity spoofing gives C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Red Hat

9.8 CRITICAL

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 09:32 vuln.today

CVE Published

Aug 11, 2026 - 09:17 nvd

CRITICAL 9.8

DescriptionCVE.org

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

AnalysisAI

Authentication bypass in Red Hat PicketLink Federation's SAML implementation lets unauthenticated remote attackers impersonate any principal in any role, because the unsolicited (IdP-initiated) response handler accepts forged SAML assertions without verifying their signature or validating their contents. Successful exploitation yields full identity spoofing, enabling information disclosure and access to restricted operations. No public exploit has been identified at time of analysis, but the CVSS 9.8 rating and trivial-to-forge nature make this a high-priority flaw for any application relying on PicketLink SAML SSO.

Technical ContextAI

PicketLink is Red Hat's (JBoss) identity-federation framework historically embedded in JBoss EAP and legacy application servers to provide SAML 2.0 Web SSO; it has since been largely superseded by Keycloak/RH-SSO. The defect is in the handler for unsolicited SAML responses - the IdP-initiated SSO flow where an IdP posts an assertion to the Service Provider without a matching prior AuthnRequest. Correct SAML processing requires validating the XML signature on the assertion/response against the trusted IdP's certificate and checking conditions such as audience, timestamps, and status. Here that verification is skipped entirely, so any attacker-crafted assertion is trusted. Although the input lists CWE as N/A, the root cause maps to CWE-347 (Improper Verification of Cryptographic Signature) and CWE-287 (Improper Authentication).

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to consult the Red Hat advisory (https://access.redhat.com/security/cve/CVE-2026-10579) and Bugzilla 2480325 (https://bugzilla.redhat.com/show_bug.cgi?id=2480325) for the fixed build and apply it once published; do not deploy a version number that is not confirmed by Red Hat. As a compensating control, disable IdP-initiated / unsolicited SAML response acceptance and require SP-initiated flows so that only responses matching an outstanding AuthnRequest are processed - this closes the vulnerable path but breaks any legitimate IdP-initiated SSO. Additionally enforce strict signature validation and trusted-IdP certificate pinning at the SP, and where feasible front the SSO endpoint with a WAF or reverse proxy that rejects unsigned or malformed SAML POSTs; given PicketLink's deprecated status, the strategic remediation is migrating SAML SSO to Keycloak/RH-SSO, which supersedes PicketLink.