CVE-2026-67328

The 8.1 CVSS on CVE-2026-67328 paired with a 0.00278 EPSS score is the wrong signal to lead with — not because the EPSS is wrong, but because it measures something different from what matters here. EPSS captures current exploitation activity and tooling availability. It does not capture blast radius. This is an SSO authentication library at a chokepoint for every application that integrates it. A successful exploit doesn't yield one compromised user — it yields authentication failure across an entire ecosystem. That changes the risk calculus fundamentally. There are four reported vectors: domain verification mismatches, orphaned provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. Four independent paths to the same trust boundary means defenders must patch comprehensively while attackers only need one vector to succeed. The 'multiple vectors, one chokepoint' dynamic multiplies effective exploitability beyond what any single CVE metric reflects. The deployment model is the critical unknown. If organizations self-host this library, remediation velocity varies wildly — some patch in hours, others in months. If it's embedded in a platform that pushes updates to tenants, the blast radius concentrates. You need to determine which world you're in: audit your dependency tree, check whether the library is bundled in any PaaS or framework you consume, and treat that finding as a first-order priority. For compensating controls while patching: rate limiting and assertion replay prevention at the gateway help against active exploitation but don't address the state corruption vectors — orphaned accounts and domain verification mismatches are failures in the authentication logic layer, not the network layer. The real compensating control for those is auditing your SSO provider roster and cleaning up the provider-to-account binding graph. That's a manual, structural mitigation that most teams won't think to apply unless specifically warned. If you can't patch immediately, treat this as a higher priority than the EPSS suggests — not because exploitation is imminent, but because the blast radius of a successful exploit is disproportionate to the score. The window between disclosure and ecosystem-wide remediation is where compounding risk lives, and SSO library failures have a documented history of cascading through downstream applications in ways that are difficult to contain once exploitation begins.

Reviewed through automated stages and approved by a human before publication.