CVE-2021-3196

An issue was discovered in Hitachi ID Bravura Security Fabric 11.0.0 through 11.1.3, 12.0.0 through 12.0.2, and 12.1.0. When using federated identity management (authenticating via SAML through a third-party identity provider), an attacker can inject additional data into a signed SAML response being transmitted to the service provider (ID Bravura Security Fabric). The application successfully validates the signed values but uses the unsigned malicious values. An attacker with lower-privilege access to the application can inject the username of a high-privilege user to impersonate that user.

• CWE-347

• https://www.hitachi-id.com/cve-2021-3196-attackers-can-impersonate-another-userVendor Advisory
• https://www.hitachi.com/hirt/hitachi-sec/2021/601.htmlExploit, Vendor Advisory
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory
• https://www.hitachi-id.com/cve-2021-3196-attackers-can-impersonate-another-userVendor Advisory
• https://www.hitachi.com/hirt/hitachi-sec/2021/601.htmlExploit, Vendor Advisory
• https://www.hitachi.com/hirt/security/index.htmlVendor Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-31954Windows Common Log File System Driver Elevation of Privilege…7.8
• CVE-2021-31955Windows Kernel Information Disclosure Vulnerability5.5
• CVE-2021-31956Windows NTFS Elevation of Privilege Vulnerability7.8
• CVE-2021-31957ASP.NET Core Denial of Service Vulnerability5.9
• CVE-2021-31958Windows NTLM Elevation of Privilege Vulnerability7.5
• CVE-2021-31959Scripting Engine Memory Corruption Vulnerability6.4
• CVE-2021-31960Windows Bind Filter Driver Information Disclosure Vulnerabil…5.5
• CVE-2021-31961Windows InstallService Elevation of Privilege Vulnerability6.1
• CVE-2021-31962Kerberos AppContainer Security Feature Bypass Vulnerability9.4
• CVE-2021-31963Microsoft SharePoint Server Remote Code Execution Vulnerabil…7.1
• CVE-2021-31964Microsoft SharePoint Server Spoofing Vulnerability7.6
• CVE-2021-31965Microsoft SharePoint Server Information Disclosure Vulnerabi…5.7