---
id: CVE-2026-14917
title: >-
  A SAML authentication bypass vulnerability affects the Kong SAML plugin when
  the validate_assertion_signature option is explicitly set to false
summary: >-
  A SAML authentication bypass vulnerability affects the Kong SAML plugin when
  the validate_assertion_signature option is explicitly set to false. This
  option is enabled by default. When disabled, the plugin may extract the SAML
  identity f…
severity: high
cvss: 7.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'
cwe:
  - CWE-288
vendor: Kong
product: Kong Enterprise Gateway
affected:
  - enterprise_gateway >= 3.15.0.0 < 3.15.0.3
  - enterprise_gateway >= 3.14.0.0 < 3.14.0.12
  - enterprise_gateway >= 3.13.0.0 < 3.13.0.9
  - enterprise_gateway >= 3.12.0.0 < 3.12.0.10
  - enterprise_gateway >= 3.10.0.0 < 3.10.0.17
  - enterprise_gateway >= 3.4.0.0 < 3.4.3.29
published: '2026-09-16'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:07:38.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-14917'
references:
  - url: 'https://developer.konghq.com/gateway/changelog/#3-15-0-3'
    label: 02762ae7-200e-4b20-9b2b-a77d5b8fc4cb
tags:
  - nvd
  - cve.org
epss: 0.00694
epssPercentile: 0.50836
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-16T13:25:56.362396Z'
cvssSource: cna
ingestedAt: '2026-09-16T10:53:53.918Z'
---

## Overview

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without verifying a valid cryptographic signature.



As a result, an unauthenticated remote attacker may be able to submit a crafted SAML response and impersonate arbitrary users, including administrators

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.