8.1

CVE-2026-15556

Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4.25
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.16.0-22.redhat_00057.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.3.14-11.SP11_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.5.26-2.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.18.8-1.redhat_00003.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:5.0.31-3.SP2_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:1.10.0-46.Final_redhat_00044.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:4.1.135-1.Final_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-30.SP12_redhat_00020.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.5.5-24.SP12_redhat_00016.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:2.2.40-2.SP3_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Default Statusaffected
Version 0:7.4.25-2.GA_redhat_00001.1.el7eap
Version < *
Status unaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 7
Default Statusaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform 8
Default Statusunaffected
HerstellerRed Hat
≫
Produkt Red Hat JBoss Enterprise Application Platform Expansion Pack
Default Statusunaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.124
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
RedHat 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://access.redhat.com/security/cve/CVE-2026-15556
https://bugzilla.redhat.com/show_bug.cgi?id=2483121
https://access.redhat.com/errata/RHSA-2026:53644
https://access.redhat.com/errata/RHSA-2026:53806