Threats tagged 'ghsa-vw9v-mpfh-qwg3'

A vulnerability in Picketlink's service provider (SP) signature validation allows an attacker to forge a SAML response when the response contains zero assertion elements matching the signature check. This flaw enables authentication as any principal with any roles on the protected application.