Quick answers
- Is CVE-2026-63398 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63398 being exploited in the wild.
- How severe is CVE-2026-63398?
- Informational severity, published 30 October 2026.
- Which products and versions are affected?
- ROOST Coop prior to 1.0.2.
- Is there a fix for CVE-2026-63398?
- Yes: fixed in 1.0.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-63398 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-63398?
- Check whether you run ROOST Coop at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.0.2
Technical details
The SAML verify callback resolved authenticated users by email alone using kyselyUserFindByEmail, without binding the lookup to the organization specified in the callback path (/saml/login/:orgId). Because email addresses can exist across multiple tenants, an attacker controlling an organization's IdP signing key could submit a SAML assertion for a victim's email to another organization's callback; if both organizations had registered the same signing certificate, the assertion would verify and resolve to the target user. The fix adds organization-scoped user lookup via kyselyUserFindByEmailAndOrg to bind resolution to the callback organization.
Affected products
- ROOST Coop prior to 1.0.2
Timeline
- 2026-10-30: disclosed
- 2026-06-16: patched