Signature Optional - Analysis of CVE-2026-28323

Signature Optional - Analysis of CVE-2026-28323

The SamlConsumer.getAuthenticatedUserFromSamlResponse() method was where the authentication decision happened. This method processed SAMLResponse values. The signature verification call was gated behind a null check on the certificate data. If an administrator configured SAML authentication but did not upload a verification certificate, the checkSignature() call never executed. The method parsed the attacker-supplied XML, extracted whatever NameID the attacker placed in the assertion, and returned it as the authenticated username.

Additionally, even when a certificate was configured, a second bug in checkSignature() let unsigned responses through. When checkSignature() received a null signature, it logged a warning and returned true. This meant the only scenario where signature verification actually rejected a response was when a element was present but failed cryptographic validation. For a successful attack, just omitting the signature was enough to receive an authentication token. Beyond signature verification, the SAML processing code performed no additional checks on the incoming assertion. None of the standard SAML security properties were validated, including Destination, Audience Restriction, NotBefore / NotOnOrAfter temporal validity, InResponseTo correlation, and Issuer verification. The code trusted whatever XML the client sends, as long as it parsed as a valid SAML Response.

Because the forged SAML response must name a valid user to produce a usable session, an attacker needs to know or guess an existing username. An attacker must target an existing user account to gain meaningful access to the application. We developed a proof-of-concept exploit that forges a SAML Response for a target username and submits it to the WHD login endpoint. The tool handles session setup, CSRF token extraction, and payload construction automatically. We validated this end to end in our lab running WHD 2026.1.21384 with SAML 2.0 enabled. The entire attack completes in a single HTTP exchange after initial session setup.

Read full article\n