CVE-2026-14917
2026-09-16
10h16 +00:00
10h16 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.
As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Authentication Bypass Using an Alternate Path or Channel The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
