CVE-2024-6202HaloITSM SAML signature wrapping, log in as any user
What broke
HaloITSM's SAML verifier did not bind the XML signature to the assertion it consumed. An attacker with one valid signature constructed a new assertion and logged in as any user, including administrators. Critical. Vendor patched.
Why it matters
ITSM is where password resets, joiner tickets, and break-glass live. Impersonating an ITSM admin is an identity incident even if the corporate IdP is fine. 2024's wrapping list is not only libraries. It is every SP that rolled its own XML.
What to do
- Patch HaloITSM. If SAML was on while unpatched, review new admin agents and unexpected password-reset tickets.
- Treat ITSM SSO as tier-zero, the same way you treat the Okta support-system plane.
- Ask the vendor which SAML stack they use. If the answer is "a PHP XML parser we wrote," assume wrapping until shown otherwise.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
Related identity CVEs
Related on Start with Identity
- CVEGitHub Enterprise Server SAML XML signature wrapping
A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do no
- CVEruby-saml companion signature-wrapping bypass
The pair to CVE-2025-25291. A second signature-wrapping path in ruby-saml lets an attacker forge assertions and impersonate any user. The March 2025 patch was l
- CVEruby-saml parser differential enables signature wrapping
ReXML and Nokogiri disagree on the same SAML document. An attacker with one valid signature can wrap a new assertion and log in as any user on GitLab, omniauth-
- BlogFortinet's January SSO bypass hit boxes already patched for December's SAML bug
CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidan
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryService Provider (SP)
The application that consumes identity assertions from an IdP to grant the user access. In SAML it's the SP; in OIDC the equivalent is the Relying Party. The se
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.