What’s Vulnerable › Vulnerabilities

CVE-2026-15556: Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-11 · updated 2026-11-01
• Weakness: CWE-347

Description

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

Affected products

• Red Hat JBoss Enterprise Application Platform 7: all versions
• Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7: all versions — fixed in 0:2.16.0-22.redhat_00057.1.el7eap

How to fix

Upgrade to a fixed version: Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 0:2.16.0-22.redhat_00057.1.el7eap. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:53644
• https://access.redhat.com/errata/RHSA-2026:53806
• https://access.redhat.com/security/cve/CVE-2026-15556
• https://bugzilla.redhat.com/show_bug.cgi?id=2483121

Get alerted when CVE-2026-15556 or the next vulnerability affects your stack