VDB

CVE-2026-10579

CVE-2026-10579 PUBLISHED CVSS 9.8 CRITICAL

Reported by redhat · Published August 11, 2026

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

Risk Scores

CVSS 3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Red HatRed Hat JBoss Enterprise Application Platform 7.4.25
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.16.0-22.redhat_00057.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.3.14-11.SP11_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.5.26-2.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.18.8-1.redhat_00003.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:5.0.31-3.SP2_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:1.10.0-46.Final_redhat_00044.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:4.1.135-1.Final_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-30.SP12_redhat_00020.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.5.5-24.SP12_redhat_00016.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:2.2.40-2.SP3_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 70:7.4.25-2.GA_redhat_00001.1.el7eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:2.16.0-22.redhat_00057.1.el8eap
Red HatRed Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 80:2.3.14-11.SP11_redhat_00001.1.el8eap

…and 90 more

Timeline

  • Aug 11, 2026 Coalition ESS Score
  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 12, 2026 Distribution Patch
  • Aug 12, 2026 Security Advisory
  • Aug 24, 2026 EPSS Score
  • Aug 29, 2026 EPSS Score
  • Sep 4, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›