CVE-2020-12676

FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack".

• CWE-347

• http://packetstormsecurity.com/files/159454/FusionAuth-SAMLv2-0.2.3-Message-Forging.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Oct/1Exploit, Mailing List, Third Party Advisory
• https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_FusionAuth_Signature_Exclusion_Attack.txtExploit, Mailing List, Vendor Advisory
• https://github.com/SAMLRaider/SAMLRaiderThird Party Advisory
• https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdfExploit, Third Party Advisory
• http://packetstormsecurity.com/files/159454/FusionAuth-SAMLv2-0.2.3-Message-Forging.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2020/Oct/1Exploit, Mailing List, Third Party Advisory
• https://compass-security.com/fileadmin/Research/Advisories/2020-06_CSNC-2020-002_FusionAuth_Signature_Exclusion_Attack.txtExploit, Mailing List, Vendor Advisory
• https://github.com/SAMLRaider/SAMLRaiderThird Party Advisory
• https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdfExploit, Third Party Advisory

Published

Oct 2, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1267This security update corrects a denial of service in the Loc…4.9
• CVE-2020-12670XSS exists in Webmin 1.941 and earlier affecting the Save fu…6.1
• CVE-2020-12672GraphicsMagick through 1.3.35 has a heap-based buffer overfl…7.5
• CVE-2020-12673In Dovecot before 2.3.11.3, sending a specially formatted NT…7.5
• CVE-2020-12674In Dovecot before 2.3.11.3, sending a specially formatted RP…7.5
• CVE-2020-12675The mappress-google-maps-for-wordpress plugin before 2.54.6 …8.8
• CVE-2020-12677An issue was discovered in Progress MOVEit Automation Web Ad…6.1
• CVE-2020-12678Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-12679A reflected cross-site scripting (XSS) vulnerability in the …6.1
• CVE-2020-1268An information disclosure vulnerability exists when a Window…5.5
• CVE-2020-12680Avira Free Antivirus through 15.0.2005.1866 allows local use…5.5
• CVE-2020-12681Missing TLS certificate validation on 3xLogic Infinias eIDC3…7.5