CVE-2026-10579
Advisory lineage Upstream: 0 Downstream: 3
Awaiting Analysis
Published: 11 Aug 2026, 08:49
Last modified:17 Sept 2026, 23:26
Vulnerability Summary
Overall Risk (default)
high
70/100 CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
0.32% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
11 Aug 2026, 08:49
Published
Vulnerability first disclosed
17 Sept 2026, 23:26
Last Modified
Vulnerability information updated
Description
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
CVSS Metrics
- v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Trends
Current EPSS score: 0.32%• Percentile: 25%
Techniques & Countermeasures
- CWE-347•Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.