CVE-2021-43999: Apache Guacamole

High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days.

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.

Affected products

• Apache Guacamole: version 1.2.0 only; version 1.3.0 only

Published 2022-01-11. Last modified 2026-06-17.