Tag
Sentry SAML SSO Improper Authentication Allows User Identity Linking
2 rules 1 TTPA critical vulnerability (CVE-2026-42354) exists in Sentry's SAML SSO implementation that allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance, affecting self-hosted users with multiple organizations configured if a malicious user has permissions to modify SSO settings, while Sentry SaaS was patched in April and self-hosted users are advised to upgrade to version 26.4.1 or higher.
Admidio SAML Signature Validation Bypass Allows Forged AuthnRequests and LogoutRequests
2 rules 5 TTPsAdmidio's SAML Identity Provider implementation fails to properly validate signatures on SAML AuthnRequests and LogoutRequests, enabling attackers to bypass signature enforcement, potentially disclose user attributes via forged SSO requests, and terminate user sessions via forged SLO requests.
Sentry SAML SSO Improper Authentication Vulnerability
2 rules 1 TTP 1 CVEA critical vulnerability in Sentry's SAML SSO implementation allows account takeover by exploiting improper authentication when multiple organizations are configured, affecting versions 21.12.0 to 26.2.0 and requiring a malicious SAML Identity Provider and knowledge of the victim's email address.
OneUptime SAML SSO Authentication Bypass Vulnerability (CVE-2026-34840)
2 rules 1 TTP 1 CVEOneUptime versions prior to 10.0.42 are vulnerable to an authentication bypass due to improper SAML signature validation, allowing attackers to impersonate users by prepending unsigned assertions.
AWS SAML Provider Deletion Activity
2 rules 2 TTPsAn adversary may delete an AWS SAML provider to disrupt administrative access, hindering incident response and potentially escalating privileges within the AWS environment.
Admidio SAML Assertion Consumer Service (ACS) URL Validation Bypass
2 rules 2 TTPs 2 IOCsAdmidio's SAML IdP implementation in its SSO module is vulnerable to sending SAML responses to unvalidated Assertion Consumer Service URLs, allowing an attacker to craft a SAML AuthnRequest with an arbitrary AssertionConsumerServiceURL, causing the IdP to send the signed SAML response, containing user identity attributes, to an attacker-controlled URL, enabling impersonation of the victim user on the legitimate SP by replaying the SAML assertion.
Suspicious AWS SAML Activity Detection
2 rules 3 TTPsThis rule identifies suspicious SAML activity in AWS, such as AssumeRoleWithSAML and UpdateSAMLProvider events, which could indicate an attacker gaining backdoor access, escalating privileges, or establishing persistence.