This vulnerability is an improper authentication flaw in the SAML processing of Progress MarkLogic Server. Versions prior to 12.1.0 in the 12.x line and prior to 11.3.7 in the 11.x line fail to reject SAML assertions that should be denied. An unauthenticated remote attacker can therefore submit a crafted assertion that is accepted by the server, leading to unauthorized access to data and services. The weakness involves authentication management (CWE-287) and the misuse of SAML metadata (CWE-347).

Affected software includes Progress Software Corporation’s MarkLogic Server. All 12.x releases before version 12.1.0 and all 11.x releases before version 11.3.7 are impacted. Any deployment that uses SAML authentication with these versions is at risk.

The CVSS score of 7.5 indicates a high severity impact. EPSS data is not available, so the current exploitation probability is unknown, but the vulnerability is listed as not being part of the CISA KEV catalog. The likely attack vector is remote; an attacker who can interact with the SAML SSO process can send a malicious assertion to the affected MarkLogic Server. Successful exploitation would grant unauthorized access to protected resources, compromising confidentiality and integrity of the application’s data.