Alta Video — 2183: VMS: gosaml2 vulnerability could allow forced log out via unsigned forged LogoutRequest
Release Date
23rd of June 2026.
Overview
A vulnerability was discovered in the gosaml2 library's ValidateEncodedLogoutRequestPOST function. An attacker can force-logout any user by forging a LogoutRequest with the victim's NameID, enabling a targeted denial-of-service.
Affected Products
- Alta Video:
- All Stable upgrade channel versions before 8.1.10.
- All Beta upgrade channel versions before 8.2.4.
- Avigilon Cloud-Native Cameras:
- All Stable upgrade Channel versions before V.S.C.
- All Beta upgrade channel versions before V.B.C.
- Alta Video Cloud: before DDth Month YYYY.
Unaffected Products
Alta Video:
- All Stable upgrade channel versions after and including 8.1.10.
- All Beta upgrade channel versions after and including 8.2.4.
Avigilon Cloud-Native Cameras:
- All Stable upgrade channel versions after and including V.S.C.
- All Beta upgrade channel versions after and including V.B.C.
Alta Video Cloud: from DDth Month YYYY
Resolution
This issue has been fixed in Alta Video Beta upgrade channel version 8.2.4 and Stable upgrade channel version 8.1.10.
It is crucial that all installations running an affected version are upgraded to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface.
Vulnerability Information
- Github advisory: GHSA-pcgw-qcv5-h8ch
- CVSS score: 8.7 (Medium)
- CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Mitigations
There are no known mitigations for this issue.
Work arounds
There are no known work arounds for this issue.
Acknowledgements
Issue reported by project maintainers.
Disclosure Timeline
- 31/03/2026 Issue found
- 31/03/2026 Root cause established
- 31/03/2026 Fix identified
- 27/04/2026 Patched Alta Video (Beta upgrade channel) released
- 30/04/2026 Patched Alta Video (Stable upgrade channel) released
- 23/06/2026 Vulnerability publicly disclosed
