CVE-2026-15556: Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

Published Aug 11, 2026

Updated

A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.

Event History

Aug 11, 2026

CVE Published

via MITRE·08:49 AM

Data Sourced

via MITRE·08:49 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-15556?

CVE-2026-15556 has a high severity score of 8.1.

What vulnerability does CVE-2026-15556 describe?

CVE-2026-15556 describes a flaw in Picketlink's SAML 2.0 authentication process that allows for auth bypass.

How does CVE-2026-15556 exploit the system?

CVE-2026-15556 can be exploited by forging a SAML response with zero assertion elements that pass the signature validation.

How can I fix CVE-2026-15556?

To fix CVE-2026-15556, update Picketlink to the latest version that addresses the missing assertion validation issue.

What impact does CVE-2026-15556 have on applications?

CVE-2026-15556 can allow attackers to authenticate as any user with any roles in the affected application.

CVE-2026-15556: Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-15556?

What vulnerability does CVE-2026-15556 describe?

How does CVE-2026-15556 exploit the system?

How can I fix CVE-2026-15556?

What impact does CVE-2026-15556 have on applications?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-15556?

What vulnerability does CVE-2026-15556 describe?

How does CVE-2026-15556 exploit the system?

How can I fix CVE-2026-15556?

What impact does CVE-2026-15556 have on applications?