Start with Identity
Subscribe
Identity CVE · SAML

CVE-2024-6202HaloITSM SAML signature wrapping, log in as any user

critical
Product: HaloITSMVendor: HaloCWE-347Disclosed: 2024-06-20Status: PatchedProtocol deep diveNVD ↗

What broke

HaloITSM's SAML verifier did not bind the XML signature to the assertion it consumed. An attacker with one valid signature constructed a new assertion and logged in as any user, including administrators. Critical. Vendor patched.

Why it matters

ITSM is where password resets, joiner tickets, and break-glass live. Impersonating an ITSM admin is an identity incident even if the corporate IdP is fine. 2024's wrapping list is not only libraries. It is every SP that rolled its own XML.

What to do

  • Patch HaloITSM. If SAML was on while unpatched, review new admin agents and unexpected password-reset tickets.
  • Treat ITSM SSO as tier-zero, the same way you treat the Okta support-system plane.
  • Ask the vendor which SAML stack they use. If the answer is "a PHP XML parser we wrote," assume wrapping until shown otherwise.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.