Read the docs
TI-2020-04324 Aliases CVE-2020-5268GHSA-9475-xg6m-j7pw

Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

Priority LOW 34CWE-303Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.

Why it matters now

EPSS 0.01086 65th percentileScored 2026-11-07
Fix Fixed Saml2 (Sustainsys): 1.0.2Sustainsys.Saml2 (NuGet): 1.0.2, 2.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SustainsysSaml2before 1.0.2; 2.0.0 – 2.6.01.0.2Patch availableCNA
—Sustainsys.Saml2 (NuGet)before 1.0.21.0.2Patch availableGHSA-9475-xg6m-j7pw
—Sustainsys.Saml2 (NuGet)2.0.0 to before 2.7.02.7.0Patch availableGHSA-9475-xg6m-j7pw
  • Saml2 VendorSustainsys Affected before 1.0.2; 2.0.0 – 2.6.0 Fixed in 1.0.2 Patch available CNA
  • Sustainsys.Saml2 (NuGet) Vendor— Affected before 1.0.2 Fixed in 1.0.2 Patch available GHSA-9475-xg6m-j7pw
  • Sustainsys.Saml2 (NuGet) Vendor— Affected 2.0.0 to before 2.7.0 Fixed in 2.7.0 Patch available GHSA-9475-xg6m-j7pw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sustainsys:saml2:*:*:*:*:*:*:*:*before 1.0.2; 2.0.0 to before 2.7.0VulnerableSustainsys
  • cpe:2.3:a:sustainsys:saml2:*:*:*:*:*:*:*:* Versions before 1.0.2; 2.0.0 to before 2.7.0 Vulnerable ·Sustainsys

Remediation

  • Fix · CNA Saml2 (Sustainsys) Fixed in 1.0.2
  • Fix · GHSA-9475-xg6m-j7pw Sustainsys.Saml2 (NuGet) Fixed in 1.0.2 Advisory →
  • Fix · GHSA-9475-xg6m-j7pw Sustainsys.Saml2 (NuGet) Fixed in 2.7.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-5268
  2. 2026-10-03 Alias added: GHSA-9475-xg6m-j7pw

References

Patch 1

Advisory 4

Other 1

  • TI-2023-22282 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation CVSS 3.1HIGH 7.5
  • TI-2020-04317 Missing Token Replay Detection CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences