Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by suse

CVE-2026-78425SAML Audience Confusion Allows Cross-SP Authentication

High 7.6

In plain English

A high-severity improper authentication in github.com/neuvector/neuvector from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)7.6High
Exploit odds (30 days)0.4%top 69.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.

Affected products (as reported)

VendorProductVersions
SUSE github.com/neuvector/neuvector 0 – through v5.6.1

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

References