EUVD-2026-80387
GHSA-p8wp-m49r-5g58
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote pre-auth bypass (AV:N/AC:L/PR:N/UI:N); scope change (S:C) as gateway auth grants access to separately-protected downstream resources; admin impersonation yields C:H/I:H, A:N.
Primary rating from Vendor (Kong).
CVSS VectorVendor: Kong
Lifecycle Timeline
2DescriptionCVE.org
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.
As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
AnalysisAI
SAML authentication bypass in Kong Enterprise Gateway allows an unauthenticated remote attacker to impersonate arbitrary users, including administrators, by submitting a crafted SAML response containing an unsigned assertion. Exploitation is strictly gated by a non-default configuration: the Kong SAML plugin's validate_assertion_signature option must have been explicitly set to false, since it defaults to true - default deployments are not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Kong SAML plugin to be in use AND the validate_assertion_signature option to be EXPLICITLY set to false. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass flaw (CWE-288) but its real-world risk is strongly gated by a non-default configuration. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Kong Gateway 3.15.0.3 (Vendor-released patch), documented in the Kong Gateway changelog at https://developer.konghq.com/gateway/changelog/#3-15-0-3, and re-audit every Kong SAML plugin configuration to ensure validate_assertion_signature is true or simply omitted so the secure default applies. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Kong Enterprise Gateway instances and determine whether the SAML plugin's validate_assertion_signature option has been set to false anywhere in production, staging, or non-standard environments; where it has, re-enable signature validation immediately as an interim mitigation and treat those deployments as potentially compromised pending log review of SAML authentication events and administrator activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The official kong docker images before 1.0.2-alpine (Alpine specific) contain a blank password for a root user. Rated cr
Signature-verification bypass in Kong API Gateway Enterprise lets an unauthenticated remote attacker present a forged JW
A vulnerability was found in Konga 2.8.3 on Kong. Rated medium severity (CVSS 5.9), this vulnerability is remotely explo
Cross-site scripting (XSS) vulnerability in the phptemplate_preprocess_node function in template.php in the Inf08 theme
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today