Nixpkgs security tracker
Dismissed
(no matching packages found)
Permalink
CVE-2026-10579
9.8 CRITICAL
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): High (H)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): High (H)
Activity log
- Created & dismissed (no matching packages found) suggestion
Picketlink-federation: auth bypass in picketlink saml unsolicited-response
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
References
Affected products
eap7-netty
- *
eap7-wildfly
- *
eap7-undertow
- *
eap7-ironjacamar
- *
eap7-jackson-core
- *
eap7-glassfish-jsf
- *
eap7-jboss-remoting
- *
eap7-activemq-artemis
- *
eap7-jackson-databind
- *
picketlink-federation
eap7-jackson-annotations
- *
eap7-picketlink-bindings
- *
eap7-jackson-modules-base
- *
eap7-jackson-modules-java8
- *
eap7-picketlink-federation
- *
eap7-jboss-server-migration
- *
eap7-jackson-jaxrs-providers
- *
eap7-netty-transport-native-epoll
- *