Critical SAML Bypass Hits SolarWinds Web Help Desk

SolarWinds has disclosed a critical vulnerability, identified as CVE-2026-28323, affecting the Web Help Desk platform. The flaw allows an attacker to bypass SAML 2.0 authentication mechanisms, potentially granting unauthorized access to the application.

What's at Risk

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level that requires immediate attention from security teams. Organizations that have enabled SAML 2.0 authentication for their SolarWinds Web Help Desk instances are currently at risk.

This flaw is particularly significant for enterprises that rely on centralized identity providers to manage access to internal administrative tools. Any deployment of the software that is reachable via the internet and configured with SAML 2.0 authentication is susceptible to exploitation.

How the Flaw Works

An authentication bypass vulnerability of this nature typically occurs when an application fails to properly validate the assertions or tokens provided by an identity provider during the login process. In a standard SAML 2.0 flow, the service provider relies on a cryptographically signed response to verify a user's identity.

When this validation logic is flawed, an attacker may be able to manipulate or forge the authentication response, tricking the application into granting them a session as a legitimate user. This class of weakness often allows an attacker to masquerade as an administrator or any other user in the system without needing a password. Once inside, an attacker can typically access sensitive data, modify system configurations, or perform administrative tasks within the scope of the hijacked account.

How to Protect Your Systems

• Review the official SolarWinds security advisory for specific patching instructions and version updates.
• Ensure that all SolarWinds Web Help Desk instances are running the latest version provided by the vendor.
• If immediate patching is not possible, consider temporarily disabling SAML 2.0 authentication until the system can be secured.
• Restrict network access to the Web Help Desk interface, ensuring it is not exposed to the public internet unless absolutely necessary.
• Monitor system logs for unusual authentication patterns or unauthorized administrative activity.
• Implement network segmentation to isolate help desk infrastructure from critical internal assets.

Given the 9.8 CVSS score, this vulnerability represents an urgent security risk. Because the flaw bypasses the primary authentication mechanism, it effectively removes the barrier between an attacker and the sensitive information stored within the help desk system. Promptly applying the vendor's recommended updates is the only way to ensure the integrity of your authentication workflow and prevent unauthorized access.