CVE-2015-1796
shibboleth: no CVSS score yet. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.opensaml:opensaml 2.6.5.
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-254
- Published
- Modified
- Record from
- the NVD, synced
Affected
- shibboleth:identity_provider
- shibboleth:opensaml_java
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-78fq-w796-q537 | Maven | org.opensaml:opensaml | <2.6.5 | 2.6.5 |
| GHSA-78fq-w796-q537 | Maven | edu.internet2.middleware:shibboleth-identityprovider | <2.4.4 | 2.4.4 |