Signature Optional Analysis of CVE-2026-28323

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://bishopfox.com/blog/signature-optional-analysis-of-cve-2026-28323
• Blog Title: Signature Optional: Analysis of CVE-2026-28323
• Suggested Section: Pentesting Web > SAML Attacks > Unsigned SAML Responses, Fail-Open Signature Validation, and Assertion Context Validation

🎯 Content Summary

Overview and impact

CVE-2026-28323 is a critical unauthenticated SAML 2.0 authentication bypass affecting SolarWinds Web Help Desk (WHD) 2026.1 and all earlier versions. It has a CVSS 3.1 score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. SolarWinds fixed it in WHD 2026.2.1, released on July 30, 2026. The Bishop Fox analysis was published on September 3, 2026, and credits Dhabales...

🔧 Technical Details

Fail-open verification controlled by nullable configuration: If an authentication handler only performs signature verification when a certificate or trust object is non-null, an empty configuration can transform attacker-controlled identity data into a trusted login. Test SAML consumers with the signing certificate removed or unset. Secure implementations must reject authentication when SAML is enabled but trust material is missing.

Absent-signature versus invalid-signature bypass: A verifier can reject malformed signatures while accepting messages that omit signatures entirely. Trace signature lookup behavior and test both cases separately. If a helper returns null when no assertion-level or response-level <Signature> exists and the caller treats that state as success, omit the signature instead of trying to forge one. This bypasses the cryptographic validator branch completely.

Forged S...

🤖 Agent Actions

Updated src/pentesting-web/saml-attacks/README.md.

Added:

• Missing-signature versus invalid-signature differential testing.
• Nullable trust/certificate fail-open behavior.
• Stateful forged-response testing workflow.
• Assertion-context validation matrix covering issuer, destination, audience, timing, InResponseTo, and status.
• Numbered SolarWinds and Bishop Fox references with linked citations.

Validation passed: git diff --check, reference numbering, citation targets, source uniqueness, and forbidden-source checks. mdbook was not installed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://bishopfox.com/blog/signature-optional-analysis-of-cve-2026-28323

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > SAML Attacks > Unsigned SAML Responses, Fail-Open Signature Validation, and Assertion Context Validation".

Repository Maintenance:

• MD Files Formatting: 998 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0