CVE-2024-6202HaloITSM SAML signature wrapping, log in as any user
What broke
HaloITSM's SAML verifier did not bind the XML signature to the assertion it consumed. An attacker with one valid signature constructed a new assertion and logged in as any user, including administrators. Critical. Vendor patched.
Why it matters
ITSM is where password resets, joiner tickets, and break-glass live. Impersonating an ITSM admin is an identity incident even if the corporate IdP is fine. 2024's wrapping list is not only libraries. It is every SP that rolled its own XML.
What to do
- Patch HaloITSM. If SAML was on while unpatched, review new admin agents and unexpected password-reset tickets.
- Treat ITSM SSO as tier-zero, the same way you treat the Okta support-system plane.
- Ask the vendor which SAML stack they use. If the answer is "a PHP XML parser we wrote," assume wrapping until shown otherwise.
After you patch
A SAML bypass means the service provider accepted an assertion it should have rejected, so anyone who exploited it authenticated as a real user and left a normal-looking log line.
- Revoke every session issued by the affected service provider, then rotate its session signing keys. Patching stops new forgeries and does nothing about sessions already minted.
- Audit administrative accounts and group memberships for changes during the exposure window. Signing in as an administrator is the point of this class, and adding a second account is the standard persistence step.
- Rotate the identity provider signing certificate if the flaw involved signature validation, and confirm the service provider pins the expected certificate rather than trusting anything in the assertion.
- Check your own implementation for the same class: exact-match comparison on verification results, rejection of unexpected signature algorithms, and audience and recency checks on every assertion. See SAML 2.0 and SAML vs OIDC.
Sources
Related identity CVEs
Related on Start with Identity
- CVEGitHub Enterprise Server SAML XML signature wrapping
A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do no
- CVEruby-saml companion signature-wrapping bypass
The pair to CVE-2025-25291. A second signature-wrapping path in ruby-saml lets an attacker forge assertions and impersonate any user. The March 2025 patch was l
- CVEruby-saml parser differential enables signature wrapping
ReXML and Nokogiri disagree on the same SAML document. An attacker with one valid signature can wrap a new assertion and log in as any user on GitLab, omniauth-
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- PodcastAuth0
The late Vittorio Bertocci's interviews with the authors of OAuth, OpenID Connect, FIDO, and SAML. Ended in 2022, and still the best audio archive on identity s
- BlogExploited NetScaler SAML zero-day forces a second upgrade after the September patch
CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV si
Technique
This CVE is an instance of Federation trust abuse and SAML forgery. A service provider that accepts a SAML assertion it should have rejected treats a forged identity as authenticated, because the failure sits in signature validation code, not in cryptography.