CVE-2026-15556: Picketlink SAML Auth Bypass Vulnerability

CVE-2026-15556 Overview

CVE-2026-15556 is an improper signature verification flaw [CWE-347] in PicketLink's Service Provider (SP) SAML response validation. The SP accepts SAML responses containing zero assertion elements that match the signature check. An attacker with low-privileged access can forge a SAML response and authenticate as any principal with arbitrary roles on the protected application.

Red Hat has published advisories addressing the flaw in affected products. The vulnerability affects confidentiality and integrity of protected applications relying on PicketLink for SAML-based single sign-on.

Critical Impact
Attackers can forge SAML responses to impersonate any user and assume arbitrary roles on applications that use PicketLink for SAML authentication.

Affected Products

PicketLink SAML Service Provider components
Red Hat products bundling PicketLink (see RHSA-2026:53644)
Red Hat products bundling PicketLink (see RHSA-2026:53806)

Discovery Timeline

2026-08-11 - CVE-2026-15556 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-15556

Vulnerability Analysis

The Security Assertion Markup Language (SAML) protocol relies on XML signatures to prove that assertions issued by an Identity Provider (IdP) have not been tampered with. PicketLink acts as a Service Provider that consumes these signed SAML responses and grants access based on the asserted identity and roles.

The flaw resides in how PicketLink's SP validates the signature against the assertion set. When a SAML response contains zero assertion elements matching the signature check, PicketLink still treats the response as valid. This allows attacker-controlled assertion content to be accepted without cryptographic verification.

An authenticated attacker with any low-privilege account can craft a SAML response with forged assertions and successfully authenticate as any principal, including administrators, with any set of roles on the protected application.

Root Cause

The root cause is improper verification of cryptographic signatures [CWE-347]. The signature-matching logic fails to enforce that at least one assertion element used for authentication decisions is covered by the validated signature. The check therefore passes even when the signed element count is zero, decoupling the trust decision from the cryptographic proof.

Attack Vector

The attack is network-based and requires low privileges but no user interaction. An attacker submits a crafted SAML response to the PicketLink-protected SP endpoint. The response is structured so that the assertion elements evaluated for identity and role claims are not the elements covered by the signature, or no assertion elements match the signature scope at all.

Because PicketLink accepts this state as valid, the SP maps the attacker-supplied NameID and AttributeStatement values to the application session. The attacker then operates with the impersonated identity and roles until the session expires.

No verified public exploit code is available. See the Red Hat CVE record for CVE-2026-15556 and Red Hat Bugzilla #2483121 for technical details.

Detection Methods for CVE-2026-15556

Indicators of Compromise

SAML responses received by the SP that contain zero assertion elements or mismatches between signed elements and assertion elements used for identity decisions.
Application authentication events showing high-privilege role assignments for accounts that normally hold only low privileges.
Successful logins as administrative principals originating from user agents or source IPs not previously associated with those accounts.

Detection Strategies

Enable verbose logging in the PicketLink SP to record inbound SAML response XML, signature validation outcomes, and the specific elements covered by the signature.
Correlate SAML authentication events with subsequent role-based authorization decisions to flag privilege jumps within a single session.
Alert on any authenticated action where the session's declared roles exceed the roles provisioned for that principal in the IdP.

Monitoring Recommendations

Forward SP and application authentication logs to a centralized analytics platform and retain them for post-incident review.
Monitor IdP-side issuance records and compare issued assertion IDs to those consumed by the SP to detect assertions the IdP never produced.
Track the volume of SAML responses per source and alert on anomalous spikes targeting the Assertion Consumer Service endpoint.

How to Mitigate CVE-2026-15556

Immediate Actions Required

Apply the fixed PicketLink packages provided in RHSA-2026:53644 and RHSA-2026:53806.
Inventory all applications using PicketLink as a SAML SP and prioritize patching of those exposing administrative roles.
Rotate session secrets and invalidate active sessions on protected applications after patching to evict any forged sessions.

Patch Information

Red Hat has issued security advisories addressing CVE-2026-15556. Administrators should install the updated PicketLink packages referenced in the Red Hat CVE page for CVE-2026-15556. The fix enforces that the signature check covers at least one assertion element used for authentication.

Workarounds

Restrict network access to the SP's SAML Assertion Consumer Service endpoint so only trusted IdP source ranges can reach it.
Enforce IdP-signed responses in addition to signed assertions and reject responses that do not carry both signatures.
Where feasible, place PicketLink-protected applications behind a reverse proxy that performs additional SAML response schema and assertion-count validation before forwarding requests.

bash

# Configuration example: restrict SP ACS endpoint to trusted IdP sources (iptables)
iptables -A INPUT -p tcp --dport 8443 -s <trusted-idp-ip>/32 -j ACCEPT
iptables -A INPUT -p tcp --dport 8443 -j DROP