Listen to this Post
The flaw stems from insufficient username validation within TeamCity’s SAML 2.0 plugin. Specifically, the SAML assertion consumer service (ACS) endpoint fails to properly verify the `NameID` or SAML attribute values before they are used to create or authenticate a session. An attacker who can forge or manipulate the contents of a SAML response can inject a crafted username, potentially bypassing the normal authentication flow. Because TeamCity trusts the authenticated identity asserted by the SAML provider, this allows the attacker to impersonate any existing user (including administrators) or to create a new account with arbitrary privileges.
This vulnerability is triggered during the authentication handshake: when a user logs in via an external IdP (e.g., Okta, ADFS, Keycloak), TeamCity’s SAML plugin receives a signed assertion. The plugin then extracts the username from the assertion and attempts to match it to a local TeamCity user. Without proper validation, an attacker can replace the legitimate username with, for example, “admin” or “system,” effectively hijacking the session.
The issue is classified as a medium severity flaw (CVSS 3.1 Base Score 6.5) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. It requires network access but no user interaction or privileges; successful exploitation leads to partial confidentiality and integrity impact (C:L/I:L). The vulnerability was introduced before TeamCity 2026.1 and is resolved in versions 2026.1 and later.
DailyCVE Form:
Platform: JetBrains TeamCity
Version: < 2026.1
Vulnerability : SAML username injection
Severity: 6.5 (Medium)
date: 2026-05-29
Prediction: Patch 2026-05-11
(end of form)
Analytics under What Undercode Say:
Check TeamCity version curl -s http://teamcity.example.com/teamcity/app/rest/server | grep -oP '<version>\K[^<]+'
Test SAML endpoint response (external PoC) curl -X POST https://teamcity.example.com/teamcity/auth/saml/consume -d 'SAMLResponse=PAYLOAD' -H "Content-Type: application/x-www-form-urlencoded"
Simple username injection POC
import requests
response = requests.get('https://teamcity.example.com/teamcity/auth/saml/login',
params={'username': 'admin'})
print(response.status_code)
Exploit:
An attacker could craft a malicious SAML assertion by modifying the `Subject/NameID` or a user attribute mapping. Using a self-signed SAML response (or by abusing weak signature validation), the attacker submits the response to the `/auth/saml/consume` endpoint. If the plugin accepts the manipulated username without further checks, the attacker gains a valid session cookie, effectively impersonating the targeted user.
Protection:
- Upgrade to TeamCity 2026.1 or later immediately.
- Enable strict signature and encryption validation for SAML responses.
- Implement `NameIDPolicy` and enforce `AllowCreate=false` where possible.
- Configure additional external authentication factors (MFA) to mitigate account takeovers.
- Monitor SAML logs for anomalous `NameID` values or repeated authentication attempts.
Impact:
Successful exploitation allows an unauthenticated attacker to bypass the SAML authentication mechanism, leading to full account takeover of any existing TeamCity user. In a CI/CD environment, this could result in manipulation of build pipelines, access to source code credentials, and escalation to server-level privileges, potentially compromising the entire software supply chain.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
