SAML2 Authentication Bypass: CVE-2026-120017 · CVSS 3.0 10.0 · SAP Note 3849308
Single sign-on moves trust from the password to the identity provider’s signature. However, Note 3849308 fixes a case where SAP NetWeaver AS ABAP, acting as a SAML2 service provider, could accept an assertion without checking that signature. As a result, an unauthenticated attacker who reaches the service provider endpoint could forge a response. The attacker could then log on as any ABAP user, including privileged ones. SAP rates the SAML2 Authentication Bypass at CVSS 10.0 with HotNews priority. In this post, we cover exposure, the fix and what to check.
SAML2 Authentication Bypass: who is exposed
The issue depends on configuration. According to SAP, affected systems did not verify signatures on incoming assertions. Therefore, treat any AS ABAP system that uses SAML2 for browser logon as in scope until you prove otherwise. Typical examples are Fiori Launchpad or Web GUI behind an IdP. In addition, the CVSS vector shows a changed scope. In practice, an administrator session forged through the SAML2 Authentication Bypass can reach connected systems through trusted RFC and other integrations.
Affected releases and correction
The note lists SAP_BASIS 702, 731, 740, 750 to 816, 804, 918 and 920 to 922. The correction makes the service provider verify the received SAML response properly. Apply the correction instructions or the listed support package. SAP keeps questions and answers in FAQ note 3849602. Unfortunately, there is no workaround, so patching is the only real fix for the SAML2 Authentication Bypass.
What to check
First, open transaction SAML2 and review every trusted identity provider. Then confirm that the system enforces signature checks for responses and assertions. After that, look through security audit logs for SAML logons of privileged users from unexpected sources. Because the SAML2 Authentication Bypass needs no credentials, this note belongs at the top of the November list. This is especially true for any internet-facing Fiori system.
You can also find exposed systems from the network side. Request https://<host>:<port>/sap/saml2/sp/metadata?sap-client=<client>. If it returns SP metadata XML, SAML2 is enabled on that client, so check it for this issue and patch it first.
SAML2 Authentication Bypass: advisory details
Component: BC-SEC-LGN-SML
SAP priority: HotNews
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source: SAP Security Note 3849308 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
