org.picketlink/picketlink-federation vulnerabilities
CVEs whose affected-version data names the org.picketlink/picketlink-federation package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-15556High· 8.1A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the prot…
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the prot…
▾ TwilightRed Hat · org.picketlink/picketlink-federationEPSS 0.33%via NVD
CVE-2026-10579Critical· 9.8A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could l…
▾ MidnightRed Hat · org.picketlink/picketlink-federationEPSS 0.46%via NVD