CVE-2026-14917

Name of the Vulnerable Software and Affected Versions Kong SAML plugin (affected versions not specified)

Description An authentication bypass exists in the Kong SAML plugin when the validate assertion signature option is explicitly set to false. In this configuration, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature. This allows an unauthenticated remote attacker to submit a crafted SAML response to impersonate arbitrary users, including administrators.

Recommendations Ensure the validate assertion signature option is enabled to maintain cryptographic signature verification. At the moment, there is no information about a newer version that contains a fix for this vulnerability.