CVE-2021-33054

SOGo 2.x before 2.4.1 and 3.x through 5.x before 5.1.1 does not validate the signatures of any SAML assertions it receives. Any actor with network access to the deployment could impersonate users when SAML is the authentication method. (Only versions after 2.0.5a are affected.)

• CWE-347

• https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.htmlThird Party Advisory
• https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/07/msg00007.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2021/dsa-5029Third Party Advisory
• https://www.sogo.nu/news.htmlProduct
• https://blogs.akamai.com/2021/06/sogo-and-packetfence-impacted-by-saml-implementation-vulnerabilities.htmlThird Party Advisory
• https://github.com/inverse-inc/sogo/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/07/msg00007.htmlMailing List, Third Party Advisory
• https://www.debian.org/security/2021/dsa-5029Third Party Advisory
• https://www.sogo.nu/news.htmlProduct

Published

Jun 4, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33040managers/views/iframe.js in FuturePress EPub.js before 0.3.8…6.1
• CVE-2021-33041vmd through 1.34.0 allows 'div class="markdown-body"' XSS, a…6.1
• CVE-2021-33044The identity authentication bypass vulnerability found in so…9.8
• CVE-2021-33045The identity authentication bypass vulnerability found in so…9.8
• CVE-2021-33046Some Dahua products have access control vulnerability in the…9.8
• CVE-2021-3305Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discov…7.8
• CVE-2021-33055Zoho ManageEngine ADSelfService Plus through 6102 allows una…9.8
• CVE-2021-33056Belledonne Belle-sip before 4.5.20, as used in Linphone and …7.5
• CVE-2021-33057The QQ application 8.7.1 for Android and iOS does not enforc…7.5
• CVE-2021-33058Improper access control in the installer Intel(R)Administrat…7.8
• CVE-2021-33059Improper input validation in the Intel(R) Administrative Too…6.7
• CVE-2021-33060Out-of-bounds write in the BIOS firmware for some Intel(R) P…7.8