CVE-2026-10579 PUBLISHED

Picketlink-federation: auth bypass in picketlink saml unsolicited-response

Assigner: redhat
Reserved: 01.06.2026 Published: 11.08.2026 Updated: 11.08.2026

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Product Status

Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4.25
Versions Default: unaffected
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.16.0-22.redhat_00057.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.3.14-11.SP11_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:1.5.26-2.Final_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.18.8-1.redhat_00003.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:5.0.31-3.SP2_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:1.10.0-46.Final_redhat_00044.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:4.1.135-1.Final_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:4.1.135-1.Final_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.5.5-30.SP12_redhat_00020.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.5.5-24.SP12_redhat_00016.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:2.2.40-2.SP3_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
Versions Default: affected
  • unaffected from 0:7.4.25-2.GA_redhat_00001.1.el7eap to * (excl.)
Vendor Red Hat
Product Red Hat JBoss Enterprise Application Platform 8
Versions Default: unaffected

References