build1 distinct publisher
Hive's SAML validator hands out a session to any Bearer token you forge
The bypass needs HTTP transport and SAML mode, so it misses the Kerberos default, but Apache published no CVSS vector and NVD has no score, which leaves triage to whoever actually reads hive-site.xml, and the 4.2.1 fix carries two more security bugs with it.
Publishers:dev.to
Reality
- Evidence62
- Adoption20
- Hype gap−8
- Incentives42