CVE-2026-10579

Published: Aug 11, 2026Modified: Oct 20, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (6)

https://access.redhat.com/errata/RHSA-2026:53644

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53645

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53646

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53806

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-10579

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2480325

Source: secalert@redhat.com

Timeline

No history available yet.