Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML train with CVE-2026-2603.

N-able N-central authentication bypass and account takeover. The first fix (CVE-2026-18556) was incomplete. Actively exploited. CISA added it to KEV on 3 August 2026.

Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 July 2026. The third TeamCity auth-bypass in this catalog.

The Windows Event Logging Service wrote WebAuthn assertions in the clear, readable by unprivileged or remote users. SpecterOps / Grafnetter chained it at Black Hat USA 2026 as Pass-the-Passkey against Entra ID. Patched July 2026.

SimpleHelp through 5.5.15 (and 6.0 pre-release) accepted OIDC ID tokens without signature verification, including alg:none. A forged token bypasses MFA. Patch is out and a public PoC exists.

Kerberos Change Password (kpasswd) did not honor PAC_REQUESTOR_SID the way the rest of AD did. A low-privilege user who can write their UPN can reset a Domain Admin password. Microsoft rated it Important. Patched April 2026.

IdentityIQ failed to authorize role edits on all versions at disclosure (April 2026). Anyone who could reach the role-editing surface could change roles they should not.

A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a control you thought you turned off.

A 2026 Keycloak client-policy enforcement bug. Client policies are how you ban implicit flow, require PKCE, or force FAPI. If they do not fire, the realm's written standard is optional.

Zimbra Collaboration Suite, chained with CVE-2025-48700, was used to steal MFA backup codes and app passwords (CERT-UA UAC-0233). Added to CISA KEV in mid-March 2026.

Active Directory treated look-alike SPNs with invisible Unicode as unique. An attacker can hijack a service name, force NTLM downgrade, and steal credentials. Semperis / Shai Laron. CVSS 8.8. Patched March 2026.

A 2026 Windows Kerberos elevation of privilege, patched by Microsoft. High severity. Read it next to KerberLoss and ResetNightmare: the 2026 AD year is a Kerberos year.

A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.

SmarterMail accepted authentication on an alternate path. CISA KEV, January 2026. Mail-admin planes keep failing the 'we protected the primary URL' test.

The Okta Java SDK could attach another request's response to yours (CWE-362). CVSS 8.4. Patched in v20.0.1, December 2025. Token mix-up in the official SDK.

The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or disable SSO' advice.

A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025 with a 23 December patch-by date.

Companion to CVE-2025-66567. Another SAML bypass in ruby-saml below 1.18.0, including 1.12.4. Same December 2025 disclosure, same 1.18.1 fix.

Disclosed 8 December 2025 with CVE-2025-66568. ruby-saml below 1.18.0, including the earlier patched 1.12.4 line, still allowed SAML assertion forgery. Fixed in 1.18.1.

node-jws before 3.2.3 / 4.0.1 can accept an HS256 JWT when the caller looks up the secret from attacker-controlled input. Medium on paper, but it is a signature bypass in the library under Auth0 and a long tail of Node verifiers.

Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-managed access.

Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.

FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the December FortiCloud SSO wave.

The KDC skipped a cryptographic step in PA-S4U-X509-USER (CWE-325). An attacker can forge an identity via S4U2self and escalate to domain compromise. Presented at Black Hat EU, December 2025. Silverfort named it CheckSum.

IdentityIQ reflected script through an incorrect content-type (CWE-79). CVSS 7.1. November 2025. An XSS on an IGA console is an admin-session theft.

Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.

Windows SMB Client improper authentication (CWE-287) that allows tampering. Not an Entra token bug, but it sits in the same Microsoft identity-adjacent patch train as the 2025 Kerberos work.

October 2025 follow-on to CVE-2025-33073. SMB Server elevation of privilege by combining Kerberos reflection with Ghost SPNs and DNS self-registration.

Keycloak could be knocked over by TLS 1.2 renegotiation. Availability of the IdP is an identity incident. Not an auth bypass.

Undocumented Actor tokens plus an Azure AD Graph tenant-validation flaw let an attacker impersonate any user, including Global Admin, in every Entra ID tenant. No MFA, no Conditional Access, no useful logs.

The OAuth SSO WordPress plugin through 6.26.12 failed JWT signature verification. A forged token becomes an administrator. Patched in 6.26.13.

Ivanti Endpoint Manager Mobile failed to validate addUser. An attacker can create or impersonate a user. Mobile-device management is an identity control plane.

Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key impersonates the entity. CVSS 6.8.

Vault's TOTP login MFA could be bypassed. Companion to the LDAP MFA bypass in the VaultFault set. Confirm the score against NVD; vendor and researcher figures circulated first.

Vault reused EntityIDs across TOTP and LDAP in a way that let one identity land on another entity. Part of VaultFault. Confirm CVSS against NVD.

A timing side-channel in Vault auth let an attacker tell valid usernames from invalid ones. Companion to CVE-2025-6010. Confirm CVSS against NVD.

Vault's auth methods leaked whether a username existed. Useful as the first step of the lockout-bypass brute force in CVE-2025-6004. Confirm CVSS against NVD.

Vault treated Userpass and LDAP usernames as case-sensitive for lockout and case-insensitive for login. Case permutation resets the lockout counter and enables mass brute force. CVSS 5.3.

Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the original write-up.

Vault's plugin catalog and audit-log handling combined into remote code execution. Cyata, Black Hat USA 2025. A flaw about nine years old. CVSS 9.1. Fixed in Vault 1.20.2 and the matching Enterprise trains.

Vault normalized policy names in a way that let a lower-privilege token become root. CVSS 7.2. Part of the August 2025 VaultFault set.

The March 2025 ruby-saml patch did not close the parser differential. CVE-2025-54572 is the incomplete-fix follow-on: still a critical SSO impersonation if you stopped at 1.12.4.

OAuth2-Proxy's skip_auth_routes regex ran against the full URI, including query parameters. A crafted query string could skip authentication on a protected path. CVSS 9.1.

A second Conjur IAM-authenticator bypass, this time through a misconfigured network device. CVSS 9.1. Same Cyata chain as CVE-2025-49827.

Conjur allowed a path traversal that disclosed files from the host. CVSS 7.1. Useful in the Cyata chain for reading configuration and secrets material after an authenticator bypass.

Conjur skipped validations that should have blocked a resource injection and permission bypass. CVSS 6.0. The lowest score in the Cyata set, and still part of the unauthenticated RCE chain.

Conjur rendered a template in Ruby without isolating attacker input. CVSS 8.6. In the Cyata chain this is the step after the IAM authenticator bypass: from forged identity to code execution.

Conjur's AWS IAM authenticator could be pointed at an attacker-controlled STS by a malformed regex (CWE-807). CVSS 9.1. One of five Cyata findings, chainable to unauthenticated RCE. Black Hat USA 2025.

Keycloak's First Broker Login had a time-of-check/time-of-use gap. A phishing or race could merge an attacker's IdP account onto a victim. CVSS 3.1 on paper. The identity lesson is larger than the score.

An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.

Kerberos authentication reflection on SMB, still abusable via Ghost SPNs after the first fix. High-severity elevation of privilege on Windows.

samlify before 2.10.0 accepted wrapped SAML signatures (CWE-347). An attacker can forge responses and impersonate any user, including admins. Node shops hit this as hard as Ruby shops hit ruby-saml.

The Windows KDC did not validate certificate-based logon (PKINIT) against NTAuth the way defenders thought. Remote elevation of privilege. Patched April 2025, with NTAuth enforcement changes you have to opt into correctly.

Quest KACE Systems Management Appliance improper authentication. On CISA KEV. A management appliance with a broken login is a fleet-wide identity incident.

Zitadel's JWT authorization grant did not check whether the client key had expired. A retired key kept working. Patched by the project.

A compressed SAML message can be inflated into a resource-exhaustion hit against ruby-saml. Not an impersonation bug, but it sits in the same March 2025 patch train as the critical wrapping flaws.

The pair to CVE-2025-25291. A second signature-wrapping path in ruby-saml lets an attacker forge assertions and impersonate any user. The March 2025 patch was later shown to be incomplete.

ReXML and Nokogiri disagree on the same SAML document. An attacker with one valid signature can wrap a new assertion and log in as any user on GitLab, omniauth-saml, and anything else still on ruby-saml before 1.12.4 / 1.18.0.

A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted by another. Disclosed by the OpenID Foundation with CVE-2025-27370.

The OpenID Connect twin of CVE-2025-27371. private_key_jwt audience is ambiguous at the spec layer, so a client assertion can be replayed across authorization servers.

A PingFederate CVE from 2025. NVD detail was thin at the time of this brief. Treat it as a PingFederate security update you should already have taken, and confirm the vendor advisory for the exact build.

StrongKey FIDO Server 4.10.0-4.15.0 confused discoverable and non-discoverable credentials. An attacker can complete passkey authentication as the victim. High. Patched by StrongKey.

A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still someone else's access token.

PingAM Java Policy Agent allowed relative path traversal and parameter injection. CNA CVSS-B 9.2. February 2025. A policy-agent bug is an authz bypass in front of every app it protects.

Keycloak did not re-check Active Directory on password reset. An expired or disabled AD account could regain access through Keycloak's reset flow.

GitHub Enterprise Server accepted a crafted SAML response because libxml2 canonicalization quirks let the signed XML and the consumed XML diverge. High-severity SSO impersonation on self-hosted GitHub.

A medium-severity Kerberos information-disclosure in Windows. Not a domain-compromise bug on its own, but it sits in the same 2025 Kerberos patch train as the S4U and PKINIT failures.

Privileged Remote Access and Remote Support accepted a malicious client request and ran OS commands as the site user. Unauthenticated. CVSS 9.8. CISA KEV. A PAM control-plane bug, not a random RCE.

IdentityIQ exposed protected static content through improper access control and directory traversal. CVSS 10.0. Disclosed December 2024. e-fixes for 8.2p8, 8.3p5, 8.4p2. Still in every 2025 IGA review.

A crafted LDAP response crashes the Windows LDAP client and can take a domain controller down. SafeBreach published a PoC in January 2025. High. Patched December 2024. Pair with CVE-2024-49112.

The critical sibling of LDAPNightmare. CVSS 9.8. Patched with CVE-2024-49113 in December 2024. If you only took the DoS patch, check the build.

AD CS V1 templates let Application Policy override EKU in a way that issues certificates with unintended enhanced key usages. High. Patched November 2024, still widely unpatched in 2025-2026 assessments.

The leftover path after CVE-2024-4985. Encrypted SAML assertions on GHES could still be forged. GitHub shipped a second hardening pass. Treat 4985 and 9487 as one upgrade.

Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on any realm using SAML. High. Red Hat patched September 2024.

The original 2024 ruby-saml authentication bypass (CVSS 10.0). It is outside the last twelve months, but every 2025 ruby-saml CVE is an incomplete-fix descendant. If you are still on a pre-2024 library, start here.

A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do not trust encrypted assertions to save a wrapping bug.

Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastPass phishing research and the 52-character DelAuth advisory, which did not get a CVE.

A chosen-prefix MD5 collision on the RADIUS Response Authenticator lets a man-in-the-middle forge Access-Accept, bypass MFA, and escalate when CHAP/PAP run without Message-Authenticator. Protocol-wide. Vendors were still shipping patches into 2026.

HaloITSM accepted a wrapped SAML assertion. An attacker with one valid signature could impersonate any user, including admins. Critical. Another 2024 reminder that ITSM tools are identity providers in practice.

An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosure is an identity incident on a VPN concentrator.

Cisco's SAML 2.0 implementation did not keep authorization domains apart. A token or assertion meant for one domain could authorize in another. May 2024. The protocol-level cousin of private_key_jwt audience mix-ups.

GHES with optional encrypted SAML assertions accepted a forged response. An unauthenticated attacker could provision a site administrator. Fixed in 3.9.15, 3.10.12, 3.11.10, and 3.12.4. The leftover path became CVE-2024-9487.

Starting a new authentication with prompt=login could hijack an existing Keycloak session. The re-auth step did not bind to the original user tightly enough. Patched in the April 2024 Keycloak train, assigned 2023.

The SAML POST-binding flow reflected a crafted Assertion Consumer Service URL as script. An XSS on the IdP login path is session theft. Patched with the April 2024 Keycloak train.

Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-2023-6787 and CVE-2023-6717.

Identity Security Cloud transform templates could be turned into remote code execution. Same class as Conjur's Ruby template injection, on the SaaS IGA side.

Identity Security Cloud connector configuration allowed path traversal. The 2025-2026 research notes that SCIM itself was quiet; provisioning risk sat in IdP and IGA connectors instead.

Identity Security Cloud (ISC) failed an access-control check. One of three 2024 ISC CVEs (3317/3318/3319) that still shape how we talk about SaaS IGA risk in 2025-2026.

The forest-trust sibling of CVE-2024-26248. PAC validation could be skipped across a trust. Same April 2024 patch train, same staged enforcement.

A process could spoof the PAC signature and skip the CVE-2022-37967 checks Microsoft added in KB5020805. April 2024. Enforcement is staged: both DCs and clients must be updated or Kerberos can break.

Unauthenticated attacker becomes a TeamCity administrator on on-prem instances. CVSS 9.8. Widely exploited. CISA KEV. The 2024 sequel to CVE-2023-42793, and the reason the 2026 agent-polling bypass was treated as urgent.

ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. Pair with CVE-2024-1708 (path traversal) for the RCE chain.

SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CISA KEV. The SAML ACS became the way back in.

Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclosure of a 2023 bug. The VPN login was optional.

An unauthenticated machine-in-the-middle can impersonate a Windows Kerberos server. CVSS 8.8. January 2024 Patch Tuesday. The 2024 opening shot in a two-year Kerberos year.

A buffer over-read on NetScaler ADC/Gateway leaked session tokens in the clear. Attackers replayed them and skipped the login, including MFA. CISA KEV. October 2023. The textbook session-hijacking CVE.

Unauthenticated request becomes administrator, then code execution, on TeamCity On-Premises before 2023.05.4. CVSS 9.8. CISA KEV. Used by Russian state actors. The 2023 original of a three-year TeamCity pattern.

Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the matching Enterprise trains.

Ivanti Sentry (MobileIron Sentry) skipped authentication on an administrative API. CISA KEV. August 2023. The gateway in front of EPMM had its own unlocked door.

Every supported EPMM 11.8-11.10 release exposed restricted API functionality with no login. Attackers pulled user and device data, then chained CVE-2023-35081. CISA KEV. July 2023. MDM is an identity control plane.

SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9.8. CISA KEV. Chained with CVE-2023-24955 for RCE.

PaperCut NG/MF improper authentication. A 2023 CVE that remains on CISA KEV and in 2025-2026 ransomware playbooks. Print-management appliances keep getting treated as low-value. They are not.

The critical sibling of CVE-2023-27351. Unauthenticated setup path plus built-in scripting became RCE. CISA KEV. Used by ransomware in April-May 2023. Print servers hold AD bind accounts.

A crafted Outlook appointment set PidLidReminderFileParameter to an attacker UNC path. The client leaked NTLM hashes when the reminder fired. No user click. CISA KEV. March 2023. Credential theft as a calendar invite.

The 2022 AD CS cert-based privilege escalation, still observed in incident response in 2025 (Rapid7, Unit 42). CVSS 8.8. The durable control is strong certificate mapping (KB5014754), not only the original patch.