Improper Authentication in OpenSAML
Date: 2022-05
Affected: maven/org.opensaml:opensaml, maven/org.opensaml:opensaml
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2011-1411
CWE: CWE-287

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."


Mitigations:

Architectural layers (MAESTRO):