Description

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-11T09:17:12.260Z",
  "pubdate": "2026-08-11T09:17:12.260Z",
  "executiveSummary": "A critical vulnerability exists within the unsolicited response handler of Picketlink Federation SAML, leading to an authentication bypass condition. This security flaw enables an unauthenticated remote attacker to supply cryptographically forged Security Assertion Markup Language (SAML) assertions directly to the target application.\nThe vulnerability stems from a complete absence of verification and validation mechanisms for unsolicited SAML responses processed by the handler. Consequently, the affected system blindly trusts incoming assertion payloads without confirming digital signatures, assertion validity periods, issuer authenticity, or trust paths.\nSuccessful exploitation allows an unauthenticated adversary to successfully authenticate as any arbitrary principal, including administrative accounts, and assume any assigned role within the system. The potential business impact is severe, encompassing unauthorized information disclosure, execution of restricted operations, privilege escalation, and full compromise of system confidentiality, integrity, and availability.\nThe attack requires network access to the vulnerable endpoint hosting the Picketlink Federation SAML unsolicited response handler. No prior credentials, specialized privileges, or interaction from legitimate users are required to execute the exploit successfully.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of assertion processing logic within the unsolicited response handler component of Picketlink Federation SAML. Specifically, when handling unsolicited SAML responses—where an Identity Provider (IdP) pushes an assertion to the Service Provider (SP) without a preceding authentication request initiated by the SP—the component fails to execute critical cryptographic and structural validation routines.\nIn a secure SAML implementation, the receiving component must validate the digital signature of the assertion or the enclosing XML document using the trusted public key or certificate of the issuing IdP. Furthermore, the handler must evaluate temporal validity conditions such as NotBefore and NotOnOrAfter timestamps, check audience restrictions, and ensure the assertion has not been replayed. In Picketlink Federation SAML, the unsolicited response handler omits these validation checks entirely.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious XML-based SAML assertion. Inside this crafted payload, the attacker populates the NameID element with the username or principal identifier of the target victim they intend to impersonate, and injects arbitrary role attributes into the authorization assertion statements. Because the handler performs no signature verification, the attacker does not need access to the private key of a legitimate Identity Provider to sign the XML payload.\nSecond, the attacker transmits this forged SAML response directly to the unsolicited response handler endpoint via HTTP POST. Third, the vulnerable handler parses the incoming XML structure, extracts the principal identity and role assertions without performing any validation checks, and establishes an active authenticated session for the specified user.\nAs a result of this post-exploitation state, the attacker gains full access rights and privileges associated with the targeted principal, permitting unauthorized access to sensitive backend functionalities, restricted operations, and confidential data pools across the application environment."
}