Description
A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-activemq-artemis +15 | 2.16.0-22.redhat_00057.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-glassfish-jsf | 2.3.14-11.SP11_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-ironjacamar +8 | 1.5.26-2.Final_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jackson-core +10 | 2.18.8-1.redhat_00003.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-remoting | 5.0.31-3.SP2_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-jboss-server-migration +2 | 1.10.0-46.Final_redhat_00044.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-netty +26 | 4.1.135-1.Final_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-api +7 | 2.5.5-24.SP12_redhat_00016.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-picketlink-bindings +1 | 2.5.5-30.SP12_redhat_00020.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-undertow | 2.2.40-2.SP3_redhat_00001.1.el7eap | RHSA-2026:53644 |
| Red Hat Jboss Enterprise Application Platform Els 7 | eap7-wildfly +4 | 7.4.25-2.GA_redhat_00001.1.el7eap | RHSA-2026:53644 |
Advisories 1
- RHSA-2026:53644 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.25 security pdate Red Hat Security Advisories (RHSA) · Nov 13, 2026
References
- RHSA-2026:53644 vendor-advisory
- RHSA-2026:53806 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-15556 vdb-entry
- RHBZ#2483121 issue-tracking