Critical severity · published Aug 11, 2026
CVE-2026-10579
Picketlink-federation: auth bypass in picketlink saml unsolicited-response
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat JBoss Enterprise Application Platform 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat JBoss Enterprise Application Platform 7
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-10579
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-10579
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:53644
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:53645
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:53646
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:53806
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-10579
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2480325
More from Red Hat JBoss Enterprise Application Platform 7
9.8
CVE-2026-49875
Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils
9.8
CVE-2026-27727
mchange-commons-java: Remote Code Execution via JNDI Reference Resolution
9.6
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.1
CVE-2026-28369
Undertow: undertow: request smuggling via malformed http request headers
9.1
CVE-2026-28367
Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator