PoC Archive PoC Archive

tag

Sso

  • CVE-2026-46490 / GHSA-34r5-q4jw-r36m web HIGH 8.8

    samlify SAML AttributeValue XML Injection → Privilege Escalation (CVE-2026-46490)

    samlify's template substitution engine (replaceTagsByValue / escapeTag in src/libsaml.ts) only XML-escapes values that are substituted into XML attribute contexts; values substituted into element text context (such as…

    Patched 2026-07-05
  • CVE-2026-1529 web CRITICAL

    Keycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529

    Keycloak's organization invitation flow accepts a JWT invitation token to scope a new user's registration to a specific organization, but the server does not properly validate that the token's claims (notably the organization ID) have not been tampered with…

    Unverified 2026-07-05
  • CVE-2026-25854 web MEDIUM 6.1

    Apache Tomcat LoadBalancerDrainingValve — Cross-System Open Redirect / Session Fixation (CVE-2026-25854)

    When a Tomcat cluster node is marked disabled/draining, its LoadBalancerDrainingValve invalidates the invalid/stale session and constructs a redirect using the raw, attacker-supplied request URI. If that URI begins with //, Tomcat preserves the double slash,…

    Patched 2026-07-05
  • CVE-2025-59718, CVE-2025-59719 network CRITICAL 9.8 KEV EPSS 63%

    Fortinet FortiCloud SSO Authentication Bypass

    CVE-2025-59718 and CVE-2025-59719 are closely related authentication-bypass vulnerabilities (CWE-347: Improper Verification of Cryptographic Signature) in Fortinet products that use the FortiCloud SSO login feature. Both were disclosed by Fortinet on 9…

    Unverified 2026-05-17