Rockmelodies

An authentication bypass exists in the SAML v2.0 service provider. The system accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when the `WantAssertionsSigned` variable is set to false. This allows unauthenticated remote attackers to submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on access to dependent applications.

An open redirect issue exists where unauthenticated attackers can redirect users by providing an unverified `id token hint` to the '/oauth2/connect/endSession' endpoint. By specifying any realm client in a forged hint, attackers can redirect victims to any registered post-logout URI, which can be used to facilitate phishing attacks by leveraging the trust associated with the OpenAM host.

The issue allows XSS via an attribute of an A element. The vendor indicates that a user is supposed to mitigate this via sanitize=true.