CVE Feed

    Dashboard / CVE / CVE-2026-25604

    CVE-2026-25604

    In AWS Auth manager, the origin of the SAML authentication has been used as provided by the client and not verified against the actual instance URL.  This allowed to gain access to different instances with potentially different access controls by reusing SAML response from other instances. You should upgrade to 9.22.0 version of provider if you use AWS Auth Manager.

    Published:Mar 9, 2026
    Last Modified:Apr 16, 2026
    EPS:Mar 9, 2026
    EPSS Score:0.00018
    CVSS Score:5.4

    Affected Products

    Vendor
    Apache
    Product
    Airflow Providers Amazon
    Vendor
    Apache
    Product
    Apache-airflow-providers-amazon

    Exploits

    https://github.com/John-Jung/CVE-2026-25604-PoC

    Common Weakness Enumeration

    CWE-346 Origin Validation Error

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High