Document vulnerability CVE-2021-43999, fixed in 1.4.0.

_security/CVE-2021-43999.md

@@ -0,0 +1,13 @@
+---
+title: Improper validation of SAML responses
+cve:   CVE-2021-43999
+fixed: 1.4.0
+---
+
+Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received
+from a SAML identity provider. If SAML support is enabled, this may allow a
+malicious user to assume the identity of another Guacamole user.
+
+Acknowledgements: We would like to thank Finn Steglich (ETAS) for reporting
+this issue.
+