SAML Authentication Bypass in ManageEngine Key Manager Plus

Executive Summary

CVE-2026-77800 is an authentication bypass vulnerability in ManageEngine Key Manager Plus versions before 7151. When single sign-on (SSO) is enabled, an attacker with a valid SAML assertion from the same identity provider (meant for another service provider) can submit it to Key Manager Plus to gain unauthorized access. The flaw allows impersonation of existing users, including administrators, potentially accessing all application functions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your ManageEngine Key Manager Plus version is below 7151. Review SAML authentication logs for unexpected login attempts or mismatched service provider assertions. Ensure SAML assertions are validated against the correct audience.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to bypass authentication and gain unauthorized access to Key Manager Plus. They could impersonate users, including administrators, and access sensitive application functions. Attackers need a valid SAML assertion from the same identity provider but intended for a different service provider.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to ManageEngine Key Manager Plus version 7151 or later. Disable SSO temporarily if an upgrade cannot be performed immediately. Monitor for unauthorized access and review SAML assertion configurations.

Useful 0 Not Useful 0