Saml
Monthly
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can bypass authentication in Apache WSS4J (4.0.0 before 4.0.2, 3.0.0 before 3.0.6, and 2.x before 2.4.4) and forge authenticated SOAP messages by submitting a crafted unsigned SAML sender-vouches assertion that carries an attacker-controlled key, which the DOM security processor accepts as proof of identity. Any SOAP service configured to accept and validate SAML sender-vouches assertions through that processor is exposed at the network layer alone, with no credentials and no user interaction required, yielding critical confidentiality and integrity impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). At time of analysis no public exploit code and no confirmed active exploitation were identified, but the low attack complexity and the fact that the vulnerable code path is a security trust boundary make this a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk case; remediation is straightforward because vendor patches exist.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
SAML SSO authentication bypass in SUSE NeuVector lets anyone who legitimately holds an account on another application behind the same corporate identity provider log into NeuVector without ever having been granted a NeuVector account. NeuVector's SAML service provider handler never validates the assertion's <Audience> element, so a bearer assertion minted for a wiki, ticketing system, or expenses tool is accepted verbatim; the internal NotInAudience warning is produced but never read, which is the CWE-287 improper-authentication root cause. Exploitation is not free - it requires SAML authentication to be enabled against an IdP shared with at least one other relying party and valid credentials in that same federation (PR:L, AT:P) - but it needs no NeuVector account, no admin rights, and no victim interaction, and it yields high confidentiality and integrity impact; there is no public exploit identified at time of analysis and no CISA KEV entry, so this is a high-priority authentication defect rather than a confirmed actively exploited one.
SQL injection in Okta Access Gateway versions prior to 2026.9.1 allows a participant in the SAML federation/authentication flow (CVSS vector PR:L) to execute unintended SQL statements against the configured backend database whenever the gateway is deployed with an 'advanced mode' datastore. The flaw arises because SAML assertion attribute values are interpolated directly into the query string before statement preparation, so attacker-influenced assertion data becomes part of the SQL rather than bound parameter data, and the scope change (S:C) reflects that compromise of the backend database crosses a security boundary beyond the gateway itself. Impact is high for confidentiality, integrity and availability, but exposure is materially limited: only deployments using advanced-mode datastores are affected, CISA SSVC records Exploitation: none and Automatable: no, EPSS is 0.24% (15th percentile, low), and no public exploit code has been identified at time of analysis.
Authentication replay in the Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier allows an attacker who can obtain a legitimate user's SAML authentication flow (for example via network interception or a man-in-the-middle position) to replay those requests and authenticate to Jenkins as that user. The flaw is rooted in the plugin's failure to implement a replay cache, and exploitation additionally requires a real user to actually perform the SAML authentication, which is why the assessed CVSS vector carries AC:H and UI:R despite a 7.5 base score. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS is low at roughly 0.47% (39th percentile), so this is a real but conditional risk affecting only instances where the SAML plugin is installed and configured as the security realm.
github.com/crewjam/saml is a saml library for the go language. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Unauthenticated remote attackers can bypass authentication in Apache WSS4J (4.0.0 before 4.0.2, 3.0.0 before 3.0.6, and 2.x before 2.4.4) and forge authenticated SOAP messages by submitting a crafted unsigned SAML sender-vouches assertion that carries an attacker-controlled key, which the DOM security processor accepts as proof of identity. Any SOAP service configured to accept and validate SAML sender-vouches assertions through that processor is exposed at the network layer alone, with no credentials and no user interaction required, yielding critical confidentiality and integrity impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). At time of analysis no public exploit code and no confirmed active exploitation were identified, but the low attack complexity and the fact that the vulnerable code path is a security trust boundary make this a genuine high-priority vulnerability rather than a high-CVSS-but-low-risk case; remediation is straightforward because vendor patches exist.
Authentication bypass in Joplin Server prior to 3.7.2 allows an unauthenticated remote attacker who can control or influence a SAML identity assertion to obtain a valid session for an existing local password-based account purely by matching the asserted email address, granting read and write access to that user's notes, files, and settings without knowledge of the local password. The defect is gated to deployments running mixed authentication - local password accounts and SAML SSO enabled together (SAML_ENABLED=true) - so SAML-only, local-only, and default single-auth installations are not exposed. The issue is fixed in version 3.7.2 via a check that rejects SSO login for non-external accounts; no public exploit identified at time of analysis.
SAML SSO authentication bypass in SUSE NeuVector lets anyone who legitimately holds an account on another application behind the same corporate identity provider log into NeuVector without ever having been granted a NeuVector account. NeuVector's SAML service provider handler never validates the assertion's <Audience> element, so a bearer assertion minted for a wiki, ticketing system, or expenses tool is accepted verbatim; the internal NotInAudience warning is produced but never read, which is the CWE-287 improper-authentication root cause. Exploitation is not free - it requires SAML authentication to be enabled against an IdP shared with at least one other relying party and valid credentials in that same federation (PR:L, AT:P) - but it needs no NeuVector account, no admin rights, and no victim interaction, and it yields high confidentiality and integrity impact; there is no public exploit identified at time of analysis and no CISA KEV entry, so this is a high-priority authentication defect rather than a confirmed actively exploited one.
SQL injection in Okta Access Gateway versions prior to 2026.9.1 allows a participant in the SAML federation/authentication flow (CVSS vector PR:L) to execute unintended SQL statements against the configured backend database whenever the gateway is deployed with an 'advanced mode' datastore. The flaw arises because SAML assertion attribute values are interpolated directly into the query string before statement preparation, so attacker-influenced assertion data becomes part of the SQL rather than bound parameter data, and the scope change (S:C) reflects that compromise of the backend database crosses a security boundary beyond the gateway itself. Impact is high for confidentiality, integrity and availability, but exposure is materially limited: only deployments using advanced-mode datastores are affected, CISA SSVC records Exploitation: none and Automatable: no, EPSS is 0.24% (15th percentile, low), and no public exploit code has been identified at time of analysis.
Authentication replay in the Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier allows an attacker who can obtain a legitimate user's SAML authentication flow (for example via network interception or a man-in-the-middle position) to replay those requests and authenticate to Jenkins as that user. The flaw is rooted in the plugin's failure to implement a replay cache, and exploitation additionally requires a real user to actually perform the SAML authentication, which is why the assessed CVSS vector carries AC:H and UI:R despite a 7.5 base score. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS is low at roughly 0.47% (39th percentile), so this is a real but conditional risk affecting only instances where the SAML plugin is installed and configured as the security realm.
github.com/crewjam/saml is a saml library for the go language. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatible) (All versions >= V2.2.0 < V2.3.0), Mendix SAML (Mendix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 9 compatible, New. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Jenkins SAML Plugin 2.0.7 and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability has been identified in Mendix SAML Module (All versions < V2.1.2). Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.