Key Manager Plus SAML Auth Bypass via Cross-SP Assertion
CVE-2026-77800 Published on November 3, 2026
Authentication bypass vulnerability
ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.
Vulnerability Analysis
CVE-2026-77800 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and a small impact on availability.
Weakness Type
Missing Critical Step in Authentication
The software implements an authentication technique, but it skips a step that weakens the technique. Authentication techniques should follow the algorithms that define them exactly, otherwise authentication can be bypassed or more easily subjected to brute force attacks.
Products Associated with CVE-2026-77800
Want to know whenever a new CVE is published for Zoho Corp Manageengine Key Manager Plus? stack.watch will email you.
Affected Versions
Zohocorp ManageEngine Key Manager Plus:- Before 7151 is affected.