{"schema_version": "1.6.1", "id": "CVE-2026-56207", "summary": "SAML authentication bypass via forged bearer token", "details": "Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user.\n\n\n\nThis issue affects Apache Impala: >=4.0.0.\n\n\n\nUsers are recommended to upgrade to version 4.5.2, which fixes this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "4.0.0"}, {"last_affected": "4.0.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/20cov78py0zqzx7dyq39ktythkwn91zs"}]}