CVE-2021-37154: ForgeRock Access Management

Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days.

In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

Affected products

• ForgeRock Access Management: before 7.0.2 (fixed in 7.0.2)

Published 2021-08-25. Last modified 2026-06-17.