{"vulnerability": "cve-2026-46490", "sightings": [{"uuid": "dd393c09-b27a-4947-b5b7-70bf42cea5a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-46490", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-34r5-q4jw-r36m", "content": "", "creation_timestamp": "2026-05-21T17:14:07.000000Z"}, {"uuid": "74acffe2-63ba-4249-a5fd-91e0166883ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-46490", "type": "seen", "source": "https://bsky.app/profile/cyberowi.pl/post/3mofr6ky2jf22", "content": "\ud83d\udea8 Luka w samlify (CVE-2026-46490): Eskalacja uprawnie\u0144 w systemach SSO Node.js\n\nWykryto luk\u0119 w popularnej bibliotece `samlify` do obs\u0142ugi SAML. Umo\u017cliwia ona eskalacj\u0119 uprawnie\u0144 przez wstrzykni\u0119cie\n\nhttps://cyberowi.pl/luka-w-samlify-cve-2026-46490-eskalacja-uprawnien-w/\n\n#cyberbezpieczenstwo", "creation_timestamp": "2026-06-16T12:08:10.001083Z"}, {"uuid": "24e40efb-54b7-4947-95d2-f8064b0a2508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "seen", "source": "https://t.me/GithubRedTeam/91344", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46490-samlify-SAML-Attribute-Injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 19:24:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46490 \u2014 samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:16.167541Z"}, {"uuid": "29ad1cd7-6e15-4dc7-ae69-db01f5e9adcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "seen", "source": "https://t.me/GithubRedTeam/91344", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46490-samlify-SAML-Attribute-Injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 19:24:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46490 \u2014 samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:32.790812Z"}, {"uuid": "b661c689-a266-4ed5-9932-071e6913843b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91344", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46490-samlify-SAML-Attribute-Injection\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BiiTts\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a JavaScript\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-30 19:24:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46490 \u2014 samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:25.623374Z"}, {"uuid": "7ab18eea-4383-4215-a755-cd152e78130e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "seen", "source": "Telegram/qDbx2CcWW1ljYrgbnUu6Ex1maUX2VAjENXcPvjZN2_dh6iU", "content": "", "creation_timestamp": "2026-07-16T19:00:25.708042Z"}, {"uuid": "f91c2284-664e-473f-9a6e-dba882d3efc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "seen", "source": "Telegram/qDbx2CcWW1ljYrgbnUu6Ex1maUX2VAjENXcPvjZN2_dh6iU", "content": "", "creation_timestamp": "2026-07-17T00:00:41.962029Z"}, {"uuid": "0a0a6097-7fe5-4fce-8998-b78c26bdff81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46490", "type": "published-proof-of-concept", "source": "Telegram/qDbx2CcWW1ljYrgbnUu6Ex1maUX2VAjENXcPvjZN2_dh6iU", "content": "", "creation_timestamp": "2026-07-18T00:00:09.643516Z"}]}