Read the docs
TI-2010-05039 Aliases CVE-2010-10002GHSA-ggj9-6x8j-49w9

SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file templates/consumer.php of the component OpenID Handler. The manipulation of the argument AuthState leads to cross site scripting. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.0 is able to address this issue. The patch is identified as d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

EPSS 0.00695 53rd percentileScored 2026-11-07
Fix Fixed simplesamlphp/simplesamlphp-module-openid (Packagist): 1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
simplesamlphpsimplesamlphp-module-openidall versions—No fix listedCNA
—simplesamlphp/simplesamlphp-module-openid (Packagist)before 1.01.0Patch availableGHSA-ggj9-6x8j-49w9
  • simplesamlphp-module-openid Vendorsimplesamlphp Affected all versions Fixed in — No fix listed CNA
  • simplesamlphp/simplesamlphp-module-openid (Packagist) Vendor— Affected before 1.0 Fixed in 1.0 Patch available GHSA-ggj9-6x8j-49w9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:simplesamlphp:simplesamlphp-module-openid:*:*:*:*:*:*:*:*before 1.0Vulnerablesimplesamlphp
  • cpe:2.3:a:simplesamlphp:simplesamlphp-module-openid:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·simplesamlphp

Remediation

  • Fix · GHSA-ggj9-6x8j-49w9 simplesamlphp/simplesamlphp-module-openid (Packagist) Fixed in 1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-10002
  2. 2026-10-03 Alias added: GHSA-ggj9-6x8j-49w9
  3. 2026-10-12 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences