CVE-2019-13496

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-11-04 · updated 2026-06-17
Weakness: CWE-354

Description

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response.

Affected products

OneIdentity Cloud Access Manager: before 8.1.4; 8.1.4 — fixed in 8.1.4

How to fix

Upgrade to a fixed version: OneIdentity Cloud Access Manager 8.1.4. Check the vendor advisory for mitigations.

References

https://github.com/FurqanKhan1/CVE-2019-13496
https://support.oneidentity.com/cloud-access-manager/kb/311391/cloud-access-manager-8-1-4-hotfix-1
https://github.com/FurqanKhan1/CVE-2019-13496
https://support.oneidentity.com/cloud-access-manager/kb/311391/cloud-access-manager-8-1-4-hotfix-1

Get alerted when CVE-2019-13496 or the next vulnerability affects your stack