CVE-2026-10579: Picketlink Federation Auth Bypass Flaw

CVE-2026-10579 Overview

CVE-2026-10579 is a critical signature verification flaw ([CWE-347]) in PicketLink Federation SAML. The unsolicited response handler accepts forged SAML assertions without performing signature verification or validation. An unauthenticated remote attacker can craft an arbitrary SAML response and authenticate as any principal in any role.

Successful exploitation grants complete authentication bypass across applications relying on PicketLink for SAML-based single sign-on. Consequences include information disclosure, access to administrative operations, and lateral movement within federated environments. Red Hat has published advisories RHSA-2026:53644 and RHSA-2026:53806 addressing the flaw.

Critical Impact
Unauthenticated attackers can forge SAML assertions to impersonate any user or administrator, bypassing all authentication controls in affected PicketLink Federation deployments.

Affected Products

PicketLink Federation SAML component
Red Hat products bundling PicketLink (see RHSA-2026:53644)
Red Hat products bundling PicketLink (see RHSA-2026:53806)

Discovery Timeline

2026-08-11 - CVE-2026-10579 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-10579

Vulnerability Analysis

The vulnerability resides in the PicketLink Federation SAML unsolicited response handler. Security Assertion Markup Language (SAML) responses carry authentication assertions signed by an Identity Provider (IdP). Service Providers (SPs) must verify these signatures before trusting any claims contained in the assertion.

The PicketLink handler processes unsolicited SAML responses without invoking signature verification or issuer validation. Any claims present in the assertion, including subject identity and role attributes, are trusted directly. This design defect defeats the entire trust model of SAML federation.

The flaw is classified under Improper Verification of Cryptographic Signature [CWE-347]. Because the handler accepts assertions from any source, attackers do not need access to IdP signing keys or valid session material.

Root Cause

The root cause is missing cryptographic signature validation on the SAML Response and Assertion elements within the unsolicited response processing path. The code path skips the standard XML Signature (XMLDSig) verification step that would normally confirm the assertion originated from a trusted IdP and was not tampered with in transit.

Attack Vector

An attacker constructs a SAML response containing an unsigned or forged assertion. The SubjectNameID is set to a target user (for example, an administrator), and the AttributeStatement includes any desired role claims. The attacker POSTs this response to the Service Provider's SAML assertion consumer endpoint as an unsolicited response.

The PicketLink handler accepts the assertion without signature checks and establishes an authenticated session with the forged identity. The vulnerability describes exploitation in prose only; see the Red Hat CVE details and Red Hat Bug Report #2480325 for the authoritative technical breakdown.

Detection Methods for CVE-2026-10579

Indicators of Compromise

Inbound HTTP POST requests to SAML assertion consumer service (ACS) endpoints without a preceding AuthnRequest correlation identifier
SAML responses with missing, malformed, or unsigned ds:Signature elements successfully producing authenticated sessions
Authentication events for privileged accounts with no corresponding IdP-side login record
Session establishment from unexpected source IP addresses immediately after a single unsolicited SAML POST

Detection Strategies

Correlate SP authentication logs against IdP issuance logs; any SP session lacking a matching IdP assertion issuance is suspect
Inspect SAML responses at the web tier for absent or invalid ds:SignatureValue and ds:X509Certificate elements
Alert on repeated POSTs to ACS endpoints from a single source referencing multiple distinct NameID values

Monitoring Recommendations

Enable verbose SAML request and response logging on PicketLink-integrated Service Providers
Forward web server and application authentication logs to a centralized analytics platform for cross-source correlation
Monitor privileged role assignments and administrative actions performed shortly after SAML session creation

How to Mitigate CVE-2026-10579

Immediate Actions Required

Apply the fixes distributed in Red Hat advisories RHSA-2026:53644 and RHSA-2026:53806
Inventory all applications using PicketLink Federation and identify SAML SP integrations
Rotate credentials, session tokens, and API keys for any account that may have been impersonated
Review authentication and audit logs for signs of forged assertion acceptance since deployment

Patch Information

Red Hat has published patches through advisories RHSA-2026:53644 and RHSA-2026:53806. Consult the Red Hat CVE page for CVE-2026-10579 for the complete list of affected product versions and corresponding fixed builds. Upstream PicketLink is no longer actively maintained; Red Hat customers should prioritize the vendor-supplied errata, and organizations still running PicketLink outside Red Hat channels should plan migration to a maintained SAML library such as Keycloak.

Workarounds

Disable unsolicited SAML response handling at the Service Provider where the deployment does not require IdP-initiated SSO
Restrict network access to SAML ACS endpoints to trusted IdP source addresses via firewall or reverse proxy rules
Place a SAML-aware gateway in front of PicketLink SPs to enforce signature verification independently
Migrate affected applications to a supported SAML implementation such as Keycloak where feasible

bash

# Example: restrict ACS endpoint access to the trusted IdP at the reverse proxy
# nginx snippet - replace 203.0.113.10 with the authorized IdP egress address
location /saml/SSO {
    allow 203.0.113.10;
    deny  all;
    proxy_pass http://picketlink_backend;
}