Advisoriesby IbisRed HatCVE-2026-10579
Red Hat JBoss Enterprise Application Platform 7.4.25: information disclosure
No fix yet
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 7.4.25 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-347