Rapid7 InsightVM versions prior to 8.34.0 suffer from a signature validation flaw on the Assertion Consumer Service cloud endpoint. The application accepts unsigned SAML assertions and issues session cookies that grant the attacker access to the target account. This flaw could let an attacker take full control of a user’s InsightVM account and any resources that the account can access. The weakness involves authentication bypass (CWE‑287) and improper authorization checks (CWE‑347).

Rapid7 Vulnerability Management InsightVM deployed via Security Console installations, any instance running a version earlier than 8.34.0 is susceptible.

The CVSS base score of 9.6 indicates a critical impact. The EPSS score is below 1%, suggesting it is rarely exploited in the wild. The vulnerability is not listed in the CISA KEV catalog, but because it permits full account take‑over, it poses a high risk if compromised. Attackers would need to craft a malicious SAML assertion and send it to the ACS endpoint, which can be done remotely over the internet, making the attack vector likely remote and publicly reachable.