Is CVE-2026-10579 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-10579?

CVE-2026-10579 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-10579

Description

A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.