CVE-2015-3158: Picketlink

Medium severity, CVSS 4.0. EPSS: 1.9% chance of exploitation in the next 30 days.

The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink before 2.8.0.Beta1 does not properly check role based authorization, which allows remote authenticated users to gain access to restricted application resources via a (1) direct request or (2) request through an SP initiated flow.

Affected products

• Picketlink Picketlink: up to and including 2.7.0

Published 2015-08-26. Last modified 2026-06-17.