PoC public SolarWinds Web Help Desk auth-bypass SolarWinds privilege-escalation
Signature Optional - Analysis of CVE-2026-28323
CVE Tools coverage
Bishop Fox researchers have disclosed CVE-2026-28323, a critical unauthenticated SAML authentication bypass affecting SolarWinds Web Help Desk versions 2026.1 and earlier, with a proof-of-concept exploit now available. The flaw permits attackers to forge a SAML Response and bypass signature verification entirely if no certificate is configured or if the assertion lacks a valid signature, enabling them to assume the identity of any known user. SolarWinds released version 2026.2.1 to address this issue by replacing the legacy SAML stack with Spring Security’s enforced validation mechanisms.
TL;DR
- This vulnerability allows unauthenticated attackers to completely bypass login screens and seize administrative control of internal help desk systems, exposing sensitive corporate data and service tickets without needing any credentials.
- CVE-2026-28323 is a critical, unauthenticated SAML authentication bypass in SolarWinds Web Help Desk (WHD) versions 2026.1 and earlier. An attacker can forge a SAML Response and POST it to the login endpoint without a valid Identity Provider, signature, or credentials. To obtain a usable session, the forged response must contain the username of an existing account. The entire attack fits in a single HTTP request once a valid username is known. SolarWinds patched the issue in WHD 2026.2.1 by replacing the legacy SAML stack with Spring Security's SAML2 service provider library. The fix is adequate: it moves signature verification from application logic into a framework that enforces it by default. Credit for the original goes to Dhabaleshwar Das.…