CVE-2026-77800: Authentication bypass vulnerability
Published Nov 3, 2026
·Updated
ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.
Event History
Nov 3, 2026
CVE Published
via MITRE·05:10 AM
Data Sourced
via MITRE·05:10 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:18 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
ManageEngine Key Manager Plus versions before 7151 are affected. The issue applies where SAML authentication is used.
2
What does an attacker need to exploit this issue?
The attacker needs a SAML assertion intended for a different service provider. No prior authentication or user interaction is required, but exploitation has high attack complexity.
3
What is the recommended remediation?
Upgrade ManageEngine Key Manager Plus to version 7151 or later.