CVE-2026-10579 — Picketlink-federation: auth bypass in picketlink saml unsolicited-response
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacke…
Published: 2026-08-11 · CVSS: 9.8 · CVSS 3.1
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7