-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opensaml:opensaml | maven | <= 2.6.4 | 2.6.5 |
| edu.internet2.middleware:shibboleth-identityprovider | maven | <= 2.4.3 | 2.4.4 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from PKIX trust engine implementations that: 1) Failed to require at least one trusted name match 2) Didn't implicitly trust the entityID itself. The core vulnerable path involves the credential validation entry point (PKIXX509CredentialTrustEngine.validate()) and the metadata-driven name resolution (MetadataPKIXValidationInfoResolver.resolve()). These would appear in stack traces during certificate validation when processing SAML messages with KeyAuthority-trusted certificates lacking proper name constraints.