Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63398— Coop has SAML cross-tenant authentication bypass

Quick assessment

Affected
roostorg coop
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Coop 是 ROOST 推出的一款开源审核与内容 moderation 工具。在 1.0.2 版本之前，其 SAML 策略的验证回调函数仅通过 依据电子邮件地址解析已认证用户，而未将查询绑定到 中指定的组织。若攻击者管理某个组织并控制该组织的 SAML 身份提供商（IdP）签名密钥，且目标组织注册了相同的签名证书，则攻击者可针对目标组织的回调端点提交一份包含受害者邮箱的 SAML 断言。该断言可通过目标证书的验证，且邮箱会解析为目标组织中的对应用户，从而以该用户身份建立会话，实现无需目标组织任何权限的跨租户账户接

CVSS 7.4 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63398

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Coop has SAML cross-tenant authentication bypass
Source: CVE Program / CVE List V5
Vulnerability Description
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated user by email alone using `kyselyUserFindByEmail`, without binding the lookup to the organization in `/saml/login/:orgId/callback`. An attacker who administers an organization and controls its SAML IdP signing key can submit an assertion for a victim email to another organization's callback when that target organization has registered the same signing certificate. The assertion verifies against the target certificate, and the email resolves to the target user, creating a session as that user and allowing full cross-tenant account takeover without privileges in the target organization. Exploitation requires the unusual configuration in which the target certificate matches a signing key controlled by the attacker. This issue is fixed in version 1.0.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
roostorg coop < 1.0.2 -

II. Public POCs for CVE-2026-63398

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63398

请登录查看更多情报信息。

Other References for CVE-2026-63398 (4)

Same Patch Batch · roostorg · 2026-10-30 · 5 CVEs total

CVE-2026-63396 8.7 HIGH Coop has a data leak via unauthenticated GraphQL Query.allOrgs
CVE-2026-63399 6.9 MEDIUM Coop: Unauthenticated org provisioning via GraphQL Mutation.createOrg
CVE-2026-63401 5.3 MEDIUM Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser
CVE-2026-63400 2.3 LOW Coop sessions are not invalidated on password reset

IV. Related Vulnerabilities

Same product: coop
Same vendor: roostorg
Same weakness: CWE-287