Vulnerability Description
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2026:53644
- https://access.redhat.com/errata/RHSA-2026:53645
- https://access.redhat.com/errata/RHSA-2026:53646
- https://access.redhat.com/errata/RHSA-2026:53806
- https://access.redhat.com/security/cve/CVE-2026-10579
- https://bugzilla.redhat.com/show_bug.cgi?id=2480325
FAQ
What is CVE-2026-10579?
CVE-2026-10579 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as an...
How severe is CVE-2026-10579?
CVE-2026-10579 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-10579?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.