CVE-2026-15013— SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
Possible ATT&CK Techniques 3AI
T1098 · Account Manipulation T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| cyberlord92 | SAML Single Sign On – SSO Login | ≤ 5.4.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-15013
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion
Source: NVD (National Vulnerability Database)
Vulnerability Description
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because `Mo_SAML_Utilities::mo_saml_cast_key()` reads the `SignatureMethod` Algorithm attribute directly from the attacker-controlled `SAMLResponse` parameter rather than enforcing the locally configured algorithm, causing the plugin to recast the IdP's RSA public key as an HMAC-SHA1 shared secret and validate the forged signature against it. This makes it possible for unauthenticated attackers to forge a SAML assertion targeting any WordPress account — including administrators — obtain valid WordPress authentication cookies, and achieve full administrator-level account takeover.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| cyberlord92 | SAML Single Sign On – SSO Login | 0 ~ 5.4.3 | - |
II. Public POCs for CVE-2026-15013
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-15013
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-15013 (1)
Other References for CVE-2026-15013 (1)
IV. Related Vulnerabilities
Same vendor: cyberlord92
- CVE-2026-12761
miniOrange Social Login and Register (Discord, Google, Twitt - CVE-2026-14245
miniOrange OTP Login, Verification and SMS Notifications <= - CVE-2026-2628
All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login <= - CVE-2026-1279
Employee Directory <= 1.2.1 - Authenticated (Contributor+) S - CVE-2025-10753
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missi
Same weakness: CWE-347
- CVE-2026-49998
Centrifugo: Dynamic JWKS key cache keyed only by `kid` allow - CVE-2026-45795
Janssen Project: JWE Request Object Signature Verification B - CVE-2026-54733
moodle-local_o365: Authentication bypass via unverified JWT - CVE-2026-46684
DataEase: Unauthorized Command Execution Vulnerability - CVE-2026-48758
sigstore-js: DSSE payloadType type-binding failure
V. Comments for CVE-2026-15013
No comments yet