Opsmanager "Change: SAML authentication now requires signed responses or assertions" breaking change

Products

• VMware Tanzu Platform Core

Issue/Introduction

In Opsman v3 the new breaking change is specified: "SAML authentication now requires signed responses or assertions". This issue was introduced due to a CVE-2026-41005.

 

 

Environment

Opsman v3

Fix is expected in Opsman v3.3.1, 3.2.7, 3.1.11

Cause

UAA incorrectly treats XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity). Because encryption uses the SP’s public key, any party can produce ciphertext that UAA can decrypt. Successful decryption does not prove the IdP issued the message.

Resolution

The workaround for the issue is: You must set wantAssertionSigned=true and ensure the IdP signs the full SAML response.

To mitigate the risk, the following must be applied:

1. Identity Provider: Configure the IdP to sign the SAML response or SAML assertions.
2. UAA Configuration: Set wantAssertionSigned=true in the UAA configuration.