Sso — PoC Archivehttps://poc.intelseclab.com/tags/sso/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000samlify SAML AttributeValue XML Injection → Privilege Escalation (CVE-2026-46490)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-46490-samlify-saml-attribute-injection/High severity (CVSS 8.8) — web · CVE-2026-46490 / GHSA-34r5-q4jw-r36m. Status: PoC. Affects: samlify (Node.js SAML library). Tags: saml, sso, xml-injection, privilege-escalation, samlify, cwe-91, identity-provider.webHighsamlssoxml-injectionprivilege-escalationsamlifycwe-91identity-providerKeycloak Unauthorized Organization Registration via Invitation Token Flaw — CVE-2026-1529https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1529-keycloak-org-registration-bypass/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-1529-keycloak-org-registration-bypass/Critical severity — web · CVE-2026-1529. Status: PoC. Affects: Keycloak (organization/invitation feature). Tags: keycloak, jwt, invitation-token, organization-registration, authentication-bypass, sso, wordpress-adjacent, identity-provider.webCriticalkeycloakjwtinvitation-tokenorganization-registrationauthentication-bypassssowordpress-adjacentidentity-providerApache Tomcat LoadBalancerDrainingValve — Cross-System Open Redirect / Session Fixation (CVE-2026-25854)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25854-tomcat-open-redirect/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-25854-tomcat-open-redirect/Medium severity (CVSS 6.1) — web · CVE-2026-25854. Status: PoC. Affects: Apache Tomcat (clustered, using LoadBalancerDrainingValve). Tags: apache-tomcat, open-redirect, session-fixation, load-balancer, cwe-601, sso, clustering, draining-valve.webMediumapache-tomcatopen-redirectsession-fixationload-balancercwe-601ssoclusteringdraining-valveFortinet FortiCloud SSO Authentication Bypasshttps://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-05-17_fortinet-forticloud-sso-auth-bypass/Critical severity (CVSS 9.8) — network · CVE-2025-59718, CVE-2025-59719 (Advisory: FG-IR-25-647). Status: Weaponized. Affects: Fortinet FortiOS, FortiProxy, FortiSwitchManager (FortiCloud SSO feature). Tags: auth-bypass, SAML, SSO, unauthenticated, FortiOS, FortiProxy, FortiSwitchManager, active-exploitation.networkCriticalauth-bypassSAMLSSOunauthenticatedFortiOSFortiProxyFortiSwitchManageractive-exploitation