Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.1epss 0.2%
exploitation probability
0.2%top 85% of all CVEs
observed exploitation
nono source reports it
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8Red Hat · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9Red Hat · Red Hat JBoss Enterprise Application Platform 8Red Hat · Red Hat JBoss Enterprise Application Platform Expansion PackReferences
https://access.redhat.com/errata/RHSA-2026:53644https://access.redhat.com/errata/RHSA-2026:53645https://access.redhat.com/errata/RHSA-2026:53646https://access.redhat.com/errata/RHSA-2026:53806https://access.redhat.com/security/cve/CVE-2026-15556https://bugzilla.redhat.com/show_bug.cgi?id=2483121