Description

Unauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-13T14:17:03.463Z",
  "pubdate": "2026-08-13T14:17:03.463Z",
  "executiveSummary": "An unauthenticated privilege escalation vulnerability affects SAML SP Single Sign On versions 5.4.3 and below. This security flaw allows unauthenticated remote adversaries to bypass authentication mechanisms and compromise the integrity and confidentiality of the targeted system. The root cause lies within the handling and validation of SAML assertions processed during the Single Sign-On workflow. By manipulating protocol interactions, an attacker can coerce the service provider into granting unauthorized elevated privileges without possessing valid user credentials or cryptographic proof of identity. The risk implications are severe, as successful exploitation enables full system access, administrative takeover, and potential lateral movement within the network architecture. The exploitation vector requires network exposure to the SAML Single Sign-On endpoint and leverages inherent weaknesses in assertion verification logic, requiring no prior authentication or specialized privileges on the affected product.",
  "technicalDetails": "The vulnerability resides within the SAML SP Single Sign On component responsible for processing Security Assertion Markup Language (SAML) responses and assertions. Specifically, the vulnerable component fails to adequately enforce cryptographic signature validation, strict audience restriction checks, or proper state verification during the assertion consumption phase. Affected versions include all instances of SAML SP Single Sign On up to and including version 5.4.3. The root cause stems from improper input validation and flawed authorization logic within the protocol handler, which incorrectly assumes that incoming assertions originate from a trusted Identity Provider (IdP) without enforcing rigorous validation criteria.\nThe attack flow begins when an unauthenticated adversary crafts a malicious SAML response payload or intercepts and modifies an existing authentication flow. Because the authentication requirements are entirely absent, the attacker interacts directly with the network-exposed SAML ACS (Assertion Consumer Service) endpoint over the network protocol. Exploitation occurs step-by-step as the adversary submits the forged SAML assertion containing arbitrary user identifiers or administrative claims to the service provider.\nThe vulnerable function processes the manipulated XML payload without verifying the digital signature against the IdP's trusted public certificate, or alternatively, suffers from XML signature wrapping (XSW) vulnerabilities. The service provider's parsing logic evaluates the unverified claims and maps the malicious assertions to an administrative or privileged user context within the internal session management subsystem. Consequently, the application issues a valid authenticated session cookie or token corresponding to the elevated privilege level. The post-exploitation impact includes complete administrative takeover of the affected service, unauthorized access to sensitive data, and potential execution of administrative actions within the application environment."
}