Elektrine
Log in Register

#saml

6 posts · Last used 15d

Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2w ago
Pega patched a SAML authentication bypass in Pega Platform, rated Critical 9.5 and High 7.0. No CVE, no known compromise. See affected versions and fixes. #Pega #SAML #AuthenticationBypass #SSO #PegaPlatform #IAM #Vulnerability #PatchNow https://securityonline.info/pega-saml-authentication-bypass/?utm_source=mastodon&utm_medium=jetpack_social
Pega Platform SAML Authentication Bypass: Critical 9.5 Flaw Patched
Daily CyberSecurity

Pega Platform SAML Authentication Bypass: Critical 9.5 Flaw Patched

Pega patched a SAML authentication bypass in Pega Platform, rated Critical 9.5 and High 7.0. No CVE, no known compromise. See affected versions and fixes.

0
0
0
0
Trail of Bits @trailofbits@infosec.exchange
· 2w ago
SAML was created in 2002 by merging four rival XML security protocols into one spec. That design still generates vulnerabilities: a canonicalization flaw via XML comments in 2018, XML round-trip bugs in Go's stdlib in 2020, a GitHub Enterprise SAML auth bypass in 2025, and more. Matt Schwager breaks down 5 design flaws behind the pattern and makes the case for moving to OIDC. https://blog.trailofbits.com/2026/09/21/saml-a-fractal-of-bad-design/ #SAML #OIDC
SAML: A fractal of bad design
The Trail of Bits Blog

SAML: A fractal of bad design

SAML, the XML-based authentication protocol that birthed the SSO industry, is fundamentally flawed due to XML complexity, canonicalization issues, enveloped signatures, and design ossification, making it vulnerable to signature wrapping attacks and parser differentials that persist despite decades of awareness. Organizations should migrate to OpenID Connect (OIDC), which avoids these pitfalls through simpler JSON-based design, detached signatures, and agile evolution.

4
1
4
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
CERT/CC discloses six Logto vulnerabilities, including CVE-2026-15611 and CVE-2026-15616, that enable SSO authentication bypass and MFA skipping. #Logto #SSO #SAML #OIDC #MFABypass #CERTCC https://securityonline.info/logto-vulnerabilities-sso-bypass/?utm_source=mastodon&utm_medium=jetpack_social
CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling
Daily CyberSecurity

CERT/CC Warns of Six Logto Vulnerabilities in SSO and MFA Handling

CERT/CC discloses six Logto vulnerabilities, including CVE-2026-15611 and CVE-2026-15616, that enable SSO authentication bypass and MFA skipping.

0
0
0
0
You've seen all posts