CVEvulnerability

CVE-2026-103314

7.4 HIGH Published 2026-10-19 Modified 2026-10-20 Official page ↗
Status
Awaiting Analysis
Published
2026-10-19
Last modified
2026-10-20
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-294

Description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Related

Weakness · CWE (1)

  • CWE-294 Authentication Bypass by Capture-replay weakness

References