https://mac.sploit.dk/tags/authentication-bypass/ Recent content in Authentication Bypass on Martin's Blog Hugo en-us Fri, 11 Sep 2026 07:00:00 +0200 https://mac.sploit.dk/blog/cve-2026-19490-netscaler-saml-logic-bug/ Fri, 11 Sep 2026 07:00:00 +0200 https://mac.sploit.dk/blog/cve-2026-19490-netscaler-saml-logic-bug/ <p>CVE-2026-19490 is a vendor-confirmed authentication bypass in NetScaler ADC and NetScaler Gateway. Citrix describes it as authentication bypass through an alternate path, but its bulletin does not identify the responsible binary or explain the failed security decision.</p> <p>Reverse engineering NetScaler 14.1 build 73.30 confirms a security-relevant control-flow difference in the proprietary <code>nsppe</code> packet engine. The SAML HTTP-Redirect handler and a normal SAML response path call the same parser with different mode values, and the Redirect value skips a later block of signature-structure policy checks.</p> <p>That is real static evidence, but it is not enough to identify the CVE&rsquo;s root cause. In particular, the unsigned Redirect branch continues only for raw policy value <code>2</code>. Two local artifacts identify <code>2</code> as deprecated permissive <code>OFF</code>, not default <code>ON</code>. The two-function explanation is therefore a candidate, disputed root cause rather than a validated default-policy bypass.</p>