CVE-2015-6254

CVE-2015-6254 describes a vulnerability in PicketLink before version 2.7.0, where the Service Provider and Identity Provider fail to validate the Destination attribute in SAML assertion responses against the message's origin. This oversight could allow remote attackers to achieve unspecified impact. The vulnerability has a CVSS score of 6.0, indicating a medium severity with an attack vector over the network, medium access complexity, and requiring authentication, potentially leading to partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.