Skip to content
Fencer Vulns
medium 6.5

CVE-2020-5268 json

Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET

published 2020-04-21 6 y ago modified 2026-09-10 1 mo ago also GHSA-9475-xg6m-j7pw , EUVD-2020-0374

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.

Patch / fix

  • nuget Sustainsys.Saml2 1.0.2, 2.7.0
  • sustainsys saml2 1.0.2, 2.7.0

Exploit prediction

1.09% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
NVD 3.1 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD 2.0 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
nuget Sustainsys.Saml2
<1.0.2
>=2.0.0, <2.7.0
1.0.2
2.7.0

Affected products

  • Sustainsys Saml2

Classification

Weakness
  • CWE-303 Incorrect Implementation of Authentication Algorithm
  • CWE-287 Improper Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.