A flaw exists in Picketlink's service‑provider signature validation logic. When a SAML response contains zero assertion elements that match the signature check, the validator accepts the response as valid. This flaw allows an attacker to forge a SAML response that authenticates as any principal with any roles on the protected application. The result is unauthorized access and potential privilege escalation, compromising the confidentiality and integrity of application data. The weakness is classified as Signature Verification Failure (CWE‑347).

The vulnerability affects software distributed under Red Hat’s JBoss Enterprise Application Platform. Specifically, all releases of JBoss EAP 7 and 8 and the associated JBoss Enterprise Application Platform Expansion Pack are impacted. No specific version ranges are provided, implying the flaw exists across the same versions that ship with the affected product bundles.

The CVSS score of 8.1 signals a high severity flaw. While the EPSS (exploit prediction) score is not available, the lack of a KEV listing indicates no known active exploitation yet. The attack vector is inferred to be through the SAML authentication flow: an adversary can craft a SAML response, missing required assertion elements, and send it to the service provider's assertion endpoint. If the target system accepts such responses, the attacker can impersonate any user, gaining full access to all application features.