Executive brief
Kong's SAML authentication plugin contains a configuration vulnerability where administrators can disable cryptographic signature validation on SAML assertions. When this security feature is turned off, attackers can forge SAML responses to impersonate any user, including administrators, without needing valid credentials. This could allow unauthorized access to APIs and systems protected by Kong's authentication.
Technical details
The Kong SAML plugin is vulnerable to authentication bypass when the validate_assertion_signature configuration option is explicitly set to false (though it defaults to true). The vulnerability exists in the SAML assertion processing logic, which extracts user identity from unsigned SAML assertions without cryptographic verification. An unauthenticated remote attacker can craft a malicious SAML response and submit it to Kong, bypassing authentication and gaining access as any user, including administrators. No user interaction or prior authentication is required. The fix involves ensuring signature validation remains enabled by default and warning administrators against disabling this critical security control.
Affected products
- Kong SAML Plugin <UNKNOWN>
Timeline
- 2026-09-16: disclosed