Bug 2480325 (CVE-2026-10579)

Summary:	CVE-2026-10579 picketlink-federation: auth bypass in Picketlink SAML unsolicited-response
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	anujha, asoldano, bbaranow, bmaxwell, bstansbe, dlofthou, istudens, ivassile, iweiss, mosmerov, msvehla, nwallace, pberan, pesilva, pjindal, pmackay, rstancel, security-response-team, smaestri, thjenkin, vdosoudi
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-20 23:09:39 UTC

Authentication Bypass — PicketLink SP accepts forged SAML 1.1 unsolicited response (no signature check) (JBoss EAP)

Complete authentication bypass on any PicketLink-federation SAML SP: the SAML 1.1 unsolicited-response handler accepts forged assertions with no signature verification, no issuer validation, and no audience restriction check, allowing an unauthenticated attacker to authenticate as any principal with any roles using a single crafted POST.
findings/jboss-eap_29.md

Comment 1 errata-xmlrpc 2026-08-11 16:37:27 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7

Via RHSA-2026:53644 https://access.redhat.com/errata/RHSA-2026:53644

Comment 2 errata-xmlrpc 2026-08-11 17:42:17 UTC

This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4.25

Via RHSA-2026:53806 https://access.redhat.com/errata/RHSA-2026:53806