CVE-2022-31122

CVE-2022-31122 is a high-severity Token Recipient Confusion vulnerability affecting Wire encrypted communication and collaboration platform versions prior to 2022-07-12/Chart 4.19.0. An attacker with specific SAML IdP metadata can delete SAML-authenticated accounts, authenticate as a user, and create arbitrary accounts within a targeted team if not managed by SCIM. The vulnerability has a CVSS score of 8.1 (High) due to its network attack vector, high impact on confidentiality, integrity, and availability, and high attack complexity. While the issue is fixed in wire-server 2022-07-12 and deployed on Wire managed services, on-premise instances require an update or disabling SAML configuration as a workaround. There is currently no known active exploitation, public exploit code, or significant community discussion surrounding this CVE.