CVE-2026-15556CWE-347

CVE-2026-15556

High · published August 11, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
14.1
In the wild
Unconfirmed
What it is

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00238 · 14.1th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-08-11T13:17Z
References (6)
https://access.redhat.com/errata/RHSA-2026:53644 · [email protected]https://access.redhat.com/errata/RHSA-2026:53645 · [email protected]https://access.redhat.com/errata/RHSA-2026:53646 · [email protected]https://access.redhat.com/errata/RHSA-2026:53806 · [email protected]https://access.redhat.com/security/cve/CVE-2026-15556 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2483121 · [email protected]
EPSS history
Timeline
  • 11 AUG 08:49Z
    Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions
    cvelistv5