Saml — PoC Archivehttps://poc.intelseclab.com/tags/saml/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000Citrix NetScaler ADC/Gateway -- Pre-Auth SAML PrefixList Heap Overflow to RCE (CVE-2026-8452)https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-8452-citrix-netscaler-saml-preauth-rce/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-08-16_cve-2026-8452-citrix-netscaler-saml-preauth-rce/Critical severity (CVSS 9.8) — network · CVE-2026-8452. Status: Patched. Affects: Citrix NetScaler ADC and NetScaler Gateway. Tags: citrix, netscaler, adc, gateway, saml, heap-overflow, preauth, rce, shellcode, webshell, freebsd, xml-signature, c14n, CVE-2026-8452.networkCriticalcitrixnetscaleradcgatewaysamlheap-overflowpreauthrceshellcodewebshellfreebsdxml-signaturec14nCVE-2026-8452samlify SAML AttributeValue XML Injection → Privilege Escalation (CVE-2026-46490)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/High severity (CVSS 8.8) — web · CVE-2026-46490 / GHSA-34r5-q4jw-r36m. Status: PoC. Affects: samlify (Node.js SAML library). Tags: saml, sso, xml-injection, privilege-escalation, samlify, cwe-91, identity-provider.webHighsamlssoxml-injectionprivilege-escalationsamlifycwe-91identity-providerApache Airflow AWS Auth Manager SAML Host Header Injection (CVE-2026-25604)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25604-airflow-saml-host-header-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25604-airflow-saml-host-header-injection/High severity — web · CVE-2026-25604. Status: PoC. Affects: Apache Airflow — apache-airflow-providers-amazon (AWS Auth Manager). Tags: saml, host-header-injection, authentication-bypass, apache-airflow, aws-iam-identity-center, cwe-346, origin-validation, token-replay.webHighsamlhost-header-injectionauthentication-bypassapache-airflowaws-iam-identity-centercwe-346origin-validationtoken-replayCitrix NetScaler ADC/Gateway Pre-Auth SAML Memory Overread — "CitrixBleed"-style Leak (CVE-2026-8451)https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-8451-citrix-netscaler-memory-leak/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_cve-2026-8451-citrix-netscaler-memory-leak/High severity (CVSS 7.5) — network · CVE-2026-8451. Status: Incomplete PoC (memory-leak/detection primitive only — no session-hijack automation). Affects: Citrix NetScaler ADC and NetScaler Gateway. Tags: memory-disclosure, SAML, Citrix, NetScaler, ADC, Gateway, citrixbleed, unauthenticated, active-exploitation.networkHighmemory-disclosureSAMLCitrixNetScalerADCGatewaycitrixbleedunauthenticatedactive-exploitationFortinet FortiCloud SSO Authentication Bypasshttps://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-59718, CVE-2025-59719 (Advisory: FG-IR-25-647). Status: Weaponized. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager (FortiCloud SSO feature). Tags: auth-bypass, SAML, SSO, unauthenticated, FortiOS, FortiProxy, FortiSwitchManager, active-exploitation.networkCriticalauth-bypassSAMLSSOunauthenticatedFortiOSFortiProxyFortiSwitchManageractive-exploitation