VULNERABILITY INTELLIGENCE
CVE-2015-1796
CVSS score4.3 MEDIUM
EPSS probability1.25%
CISA KEVNot currently listed
Published2015-07-08
Last modified2026-06-17
CVSS vectorAV:N/AC:M/Au:N/C:N/I:P/A:N
Description
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.