#saml

Analysis · May 20, 2026 · Colten Anderson

A CVSS 10 that hinged on one unchecked box: 'Validate Identity Provider Certificate'

CVE-2020-2021 let attackers bypass authentication on Palo Alto firewalls and VPNs using SAML, but only when one option was disabled: 'Validate Identity Provider Certificate.' A perfect-10 bug whose presence depended on a checkbox.