This vulnerability arises from a flaw in Picketlink's service provider (SP) signature validation for SAML responses. Specifically, if a SAML response contains zero assertion elements matching the signature check, an attacker can exploit this to forge a SAML response and authenticate as any user with arbitrary roles on the protected application. The vulnerability affects Red Hat JBoss Enterprise Application Platform 7 due to inclusion of the vulnerable picketlink-federation and picketlink-common components. Red Hat JBoss EAP 8.x is not affected as it lacks these components. The CVSS v3.1 base score is 8.1 (high severity) with network attack vector, low complexity, low privileges required, no user interaction, and high confidentiality and integrity impact. No vendor advisory indicates an official fix or patch availability at this time.

An attacker with low privileges can remotely exploit this vulnerability to bypass authentication by forging SAML responses, thereby gaining unauthorized access as any principal with any roles on the protected application. This leads to a complete compromise of confidentiality and integrity of the application data. Availability is not impacted. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-15556 for current remediation guidance. Red Hat JBoss EAP 8.x is not affected and upgrading to this version can mitigate risk. No specific mitigations are currently documented in the advisory. Customers should monitor Red Hat communications for updates on fixes or mitigations.