---
id: CVE-2026-78425
title: >-
  Authorised users of outside applications behind the same corporate identity
  provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or
  anything they legitimately hold an account on can log into their system via
  SAML SS…
summary: >-
  Authorised users of outside applications behind the same corporate identity
  provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or
  anything they legitimately hold an account on can log into their system via
  SAML SS…
severity: high
cvss: 7.6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N'
cwe:
  - CWE-287
vendor: go
product: github.com/neuvector/neuvector
affected:
  - github.com/neuvector/neuvector <= v5.6.1
published: '2026-09-17'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T19:07:38.320'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78425'
references:
  - url: 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2026-78425'
    label: meissner@suse.de
  - url: >-
      https://github.com/neuvector/neuvector/security/advisories/GHSA-wgg5-24xq-px35
    label: meissner@suse.de
tags:
  - nvd
  - cve.org
epss: 0.00364
epssPercentile: 0.27498
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-17T12:12:10.344911Z'
cvssSource: cna
ingestedAt: '2026-09-17T10:15:37.166Z'
---

## Overview

Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.