CVE-2026-15556

Published: Aug 11, 2026Modified: Oct 20, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

Related CWEs

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (6)

https://access.redhat.com/errata/RHSA-2026:53644

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53645

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53646

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2026:53806

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2026-15556

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2483121

Source: secalert@redhat.com

Timeline

No history available yet.