The vulnerability allows an attacker that controls a SAML identity provider (IdP) for one organization to create a forged assertion for a user in a different organization. The application resolves the user by email alone during the SAML callback without tying the lookup to the requesting organization, so the forged assertion is accepted and a session is started as the target user. This results in a full account takeover without any privileges in the target organization.

The issue affects the open‑source review tool Coop provided by Roostorg. Versions prior to 1.0.2 are vulnerable; version 1.0.2 and later include the fix that binds user resolution to the organization identifier in the callback route.

The CVSS score of 7.4 indicates high severity. EPSS data is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an uncommon configuration: the target organization must use the same SAML signing certificate as the attacker’s organization, otherwise the assertion would fail. When that condition is met, the attacker can successfully trigger the callback and impersonate any user with a known email address in the target tenant.