CVE-2026-10579
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A flaw was found in Picketlink Federation SAML; the unsolicited response handler would accept forged assertions with no verification or validation, permitting an unauthenticated attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Risk Assessment
The risk includes unauthorized access to systems and data, privilege escalation, and potential compromise of integrity and confidentiality.
Recommendation
Update Picketlink to a patched version immediately and implement additional SAML assertion validation mechanisms.
Original NVD description (English source)
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.