This vulnerability affects the Kong Enterprise Gateway SAML plugin when the validate_assertion_signature option is set to false, which is not the default setting. Disabling this option causes the plugin to extract the SAML identity from unsigned assertions without verifying cryptographic signatures. Consequently, an attacker can submit a malicious SAML response to bypass authentication and impersonate any user, including administrative accounts. The issue impacts multiple versions of Kong Enterprise Gateway from 3.4.0.0 up to but not including 3.4.3.29, 3.10.0.0 up to 3.10.0.17, 3.12.0.0 up to 3.12.0.10, 3.13.0.0 up to 3.13.0.9, 3.14.0.0 up to 3.14.0.12, and 3.15.0.0 up to 3.15.0.3.

An unauthenticated remote attacker can exploit this vulnerability to bypass SAML authentication and impersonate arbitrary users, including administrators. This could lead to unauthorized access to sensitive resources and administrative functions within the Kong Enterprise Gateway environment.

No explicit patch or official fix information is provided in the vendor advisory. The vulnerability arises only when the validate_assertion_signature option is explicitly set to false, which is not the default configuration. Therefore, ensuring this option remains enabled (the default) mitigates the risk. Users should verify their configuration to confirm that validate_assertion_signature is not disabled. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.