| Title | Cleo Harmony < 5.8.1.11 Authentication Bypass Issues |
|---|
| Description | SAML XML Signature Wrapping (XSW) leading to authentication bypass on Cleo Harmony
A holder of any IdP-signed SAML assertion at a federated tenant can wrap that assertion inside a forged <Response> carrying an arbitrary NameID/Subject / AttributeStatement, POST it to the SP's ACS, and receive an authenticated session as the spoofed identity. The signed assertion is preserved verbatim as a structural prop and the attacker's payload is the assertion the SP actually consumes after verification passes.
Reproduction:
1. Obtain any signed SAML response from the configured IdP for the target tenant. A normal SSO sign-in suffices.
2. Construct a wrapped response: keep the signed assertion as-is inside a `<saml:Extensions>` (or other unconsumed location); insert a sibling `<saml:Assertion>` carrying the attacker-chosen `<Subject><NameID>`, `Subject/SubjectConfirmation`, and any desired `<AttributeStatement>` (notably `Email`, since `LocalUserUtil.getNativeUserByAssertions` prefers the email attribute over `NameID`).
3. POST as `SAMLResponse=<base64>` to the ACS.
4. SP returns a `Set-Cookie: cleo.portal.sso_authentication=…` for the spoofed identity. Bearer JWT inside carries `sub` = attacker-chosen value. |
|---|
| Source | ⚠️ https://support.cleo.com/hc/en-us/articles/30258468834583-Cleo-Harmony-5-8-1-Release-Notes#Version58111 |
|---|
| User | Anonymous User |
|---|
| Submission | 07/07/2026 23:19 (2 months ago) |
|---|
| Moderation | 09/01/2026 09:20 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 397557 [Cleo Harmony up to 5.8.1.10 SAML Authentication LocalUserUtil.getNativeUserByAssertions Email improper authentication] |
|---|
| Points | 20 |
|---|