CVE-2026-103314 (CVSS 7.4)

Description

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.

Is your site exposed to CVE-2026-103314?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

7.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS — Exploit Prediction

0.0041

Probability of exploitation

0.35%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-294 CWE-294

References

Other References

https://access.redhat.com/errata/RHSA-2026:85932 https://access.redhat.com/security/cve/CVE-2026-103314 https://bugzilla.redhat.com/show_bug.cgi?id=2543879

Frequently Asked Questions

What is CVE-2026-103314? +

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity. It has a CVSS v3.1 base score of 7.4 (HIGH).

How severe is CVE-2026-103314? +

CVE-2026-103314 has a CVSS v3.1 score of 7.4 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0041, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-103314? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-67581

Authentication Bypass by Capture-replay in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled …

CVE-2026-87119

Authentication Bypass by Capture-replay in ZenHive mpp allows an attacker holding a captured subscription activation credential to charge the payer …

CVE-2026-55250

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from …

CVE-2026-103655

MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted …

CVE-2026-53424

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML …

CVE-2026-121640

An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate request between …