VULNERABILITY INTELLIGENCE
CVE-2026-10579
CVSS score9.8 CRITICAL
EPSS probability0.43%
CISA KEVNot currently listed
Published2026-08-11
Last modified2026-11-01
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Weakness classification
- secalert@redhat.com: CWE-347
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-347