Start with Identity
Subscribe
Identity CVE · SAML

CVE-2024-20355Cisco SAML 2.0 mixes authorization domains

high
Product: Cisco products (SAML 2.0)Vendor: CiscoDisclosed: 2024-05-22Status: PatchedProtocol deep diveNVD ↗

What broke

Cisco's SAML 2.0 implementation failed to separate authorization domains. An assertion or related token issued in one context could be accepted in another. Disclosed 22 May 2024. Cisco shipped product-specific fixes.

Why it matters

Audience and domain separation is how federation stays tenant-safe. This is the SAML version of CVE-2025-27371 (private_key_jwt audience ambiguity). Multi-tenant or multi-VPN Cisco deployments are the obvious victims: a login meant for environment A becomes a login for environment B.

What to do

  • Apply the Cisco advisory that names CVE-2024-20355 for each product you run (ASA/FTD/ISE-adjacent SAML integrations first).
  • Pin ACS URLs and entity IDs per environment. Shared SAML apps across prod and lab are how domain mix-ups become incidents.
  • After patching, revoke long-lived VPN or admin sessions that were established through SAML.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.