Description
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
References
- www.cve.org/CVERecord ↗
- nvd.nist.gov/vuln/detail/CVE-2026-10579 ↗
- access.redhat.com/errata/RHSA-2026:53644 ↗
- access.redhat.com/errata/RHSA-2026:53645 ↗
- access.redhat.com/errata/RHSA-2026:53646 ↗
- access.redhat.com/errata/RHSA-2026:53806 ↗
- access.redhat.com/security/cve/CVE-2026-10579 ↗
- bugzilla.redhat.com/show_bug.cgi ↗
Related CVEs
← CVE Index: search every CVE from the last 30 days
This product uses the NVD API but is not endorsed or certified by the NVD. CVSS scores do not establish exploitation.