AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Red HatCVE-2026-15556

Red Hat JBoss Enterprise Application Platform 7.4.25: improper signature check

Red Hat

CVE-2026-15556 · Published Aug 11, 2026 · updated Nov 1, 2026

High8.1
No fix yet
Red Hat advisory

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

Affected versions

PackageAffectedFixed in
Red Hat JBoss Enterprise Application Platform 7.4.25
Product
all versionsNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-347

More Red Hat advisories

All Red Hat
High 8.2Aug 11Red Hat FreeIPA: improper authorizationCVE-2026-19550no fix yetHigh 7.5Aug 11Red Hat search-v2-api. The authentication middleware: authentication bypassCVE-2026-71467no fix yetMedium 5.3Aug 11Red Hat acm-search-v2-api-rhel9.: information disclosureCVE-2026-71468no fix yetHigh 7.1Aug 11Red Hat insights-client.: information disclosureCVE-2026-71474no fix yetMedium 6.8Aug 11Red Hat insights-client. A compromised managed cluster: information disclosureCVE-2026-71475no fix yetMedium 6.3Aug 11Red Hat insights-client: secrets in logsCVE-2026-71845no fix yet