How severe is CVE-2020-5268?

CVE-2020-5268 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.

Is CVE-2020-5268 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-5268?

CVE-2020-5268 affects Sustainsys Saml2. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-5268?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-5268 published?

CVE-2020-5268 was published on 2020-04-21 and last updated on 2026-06-17.

CVE-2020-5268

CVE-2020-5268 is a medium-severity vulnerability in Sustainsys Saml2 with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.9
EPSS exploit prediction: 1% (61st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-287
Affected product: Sustainsys Saml2
Published: 2020-04-21
Last modified: 2026-06-17

Description

In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.

Frequently asked questions

What is CVE-2020-5268?: In Saml2 Authentication Services for ASP.NET versions before 1.0.2, and between 2.0.0 and 2.6.0, there is a vulnerability in how tokens are validated in some cases. Saml2 tokens are usually used as bearer tokens - a caller that presents a token is assumed to be the subject of the token. There is also support in the Saml2 protocol for issuing tokens that is tied to a subject through other means, e.g. holder-of-key where possession of a private key must be proved. The Sustainsys.Saml2 library incorrectly treats all incoming tokens as bearer tokens, even though they have another subject confirmation method specified. This could be used by an attacker that could get access to Saml2 tokens with another subject confirmation method than bearer. The attacker could then use such a token to create a log in session. This vulnerability is patched in versions 1.0.2 and 2.7.0.
How severe is CVE-2020-5268?: CVE-2020-5268 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with high attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity low, and availability none.
Is CVE-2020-5268 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (61st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-5268?: CVE-2020-5268 affects Sustainsys Saml2. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-5268?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-5268 published?: CVE-2020-5268 was published on 2020-04-21 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:sustainsys:saml2:*:*:*:*:*:*:*:*

More vulnerabilities in Sustainsys Saml2

CVE-2020-5261 — High (CVSS 8.2): Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version…
CVE-2023-41890 — High (CVSS 7.5): Sustainsys.Saml2 library adds SAML2P support to ASP.NET web sites, allowing the web site to act as a SAML2 Service…

All CVEs affecting Sustainsys Saml2 →

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →