CVE-2026-10579 is a critical authentication bypass vulnerability in the Picketlink Federation SAML component of Red Hat JBoss Enterprise Application Platform 7. The flaw resides in the unsolicited response handler, which improperly accepts forged SAML assertions without performing necessary verification or validation. This allows an unauthenticated attacker to impersonate any principal with any role, potentially leading to high-impact consequences such as information disclosure and unauthorized access to restricted operations. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (Network attack vector, low complexity, no privileges or user interaction required, unchanged scope, and high confidentiality, integrity, and availability impacts). Red Hat treats this as a cloud service vulnerability and has indicated that a patch is available. The official advisory is the authoritative source for remediation.

An unauthenticated attacker can exploit this vulnerability to authenticate as any user or role without proper verification, potentially leading to full compromise of affected systems. This includes unauthorized access to sensitive information, execution of restricted operations, and disruption of service availability. The vulnerability's high CVSS score reflects its critical impact on confidentiality, integrity, and availability.

Red Hat has made a patch available for this vulnerability and manages remediation for this cloud-hosted service. Users should apply the official patch as provided by Red Hat. Refer to the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-10579 for detailed remediation instructions and updates. No alternative mitigations are specified in the advisory.