Read the docs
TI-2026-36470 Aliases CVE-2026-49283GHSA-6929-8p9f-26jx

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

Priority MEDIUM 40CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed saml2 (simplesamlphp): 4.19.3, 4.20.2, 5.0.6 +1simplesamlphp/saml2 (Packagist): 6.2.1, 5.0.6, 4.20.2 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
simplesamlphpsaml2before 4.19.3; 4.20.0 to before 4.20.2; 5.0.0 to before 5.0.6; 6.0.0 to before 6.2.14.19.3, 4.20.2, 5.0.6, 6.2.1Patch availableCNA
—simplesamlphp/saml2 (Packagist)6.0.0 to before 6.2.16.2.1Patch availableGHSA-6929-8p9f-26jx
—simplesamlphp/saml2 (Packagist)5.0.0 to before 5.0.65.0.6Patch availableGHSA-6929-8p9f-26jx
—simplesamlphp/saml2 (Packagist)4.20.0 to before 4.20.24.20.2Patch availableGHSA-6929-8p9f-26jx
—simplesamlphp/saml2-legacy (Packagist)4.20.0 to before 4.20.24.20.2Patch availableGHSA-6929-8p9f-26jx
—simplesamlphp/saml2 (Packagist)before 4.19.34.19.3Patch availableGHSA-6929-8p9f-26jx
—simplesamlphp/saml2-legacy (Packagist)before 4.19.34.19.3Patch availableGHSA-6929-8p9f-26jx
  • saml2 Vendorsimplesamlphp Affected before 4.19.3; 4.20.0 to before 4.20.2; 5.0.0 to before 5.0.6; 6.0.0 to before 6.2.1 Fixed in 4.19.3, 4.20.2, 5.0.6, 6.2.1 Patch available CNA
  • simplesamlphp/saml2 (Packagist) Vendor— Affected 6.0.0 to before 6.2.1 Fixed in 6.2.1 Patch available GHSA-6929-8p9f-26jx
  • simplesamlphp/saml2 (Packagist) Vendor— Affected 5.0.0 to before 5.0.6 Fixed in 5.0.6 Patch available GHSA-6929-8p9f-26jx
  • simplesamlphp/saml2 (Packagist) Vendor— Affected 4.20.0 to before 4.20.2 Fixed in 4.20.2 Patch available GHSA-6929-8p9f-26jx
  • simplesamlphp/saml2-legacy (Packagist) Vendor— Affected 4.20.0 to before 4.20.2 Fixed in 4.20.2 Patch available GHSA-6929-8p9f-26jx
  • simplesamlphp/saml2 (Packagist) Vendor— Affected before 4.19.3 Fixed in 4.19.3 Patch available GHSA-6929-8p9f-26jx
  • simplesamlphp/saml2-legacy (Packagist) Vendor— Affected before 4.19.3 Fixed in 4.19.3 Patch available GHSA-6929-8p9f-26jx

Remediation

  • Fix · CNA saml2 (simplesamlphp) Fixed in 4.19.3, 4.20.2, 5.0.6, 6.2.1
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2 (Packagist) Fixed in 6.2.1 Advisory →
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2 (Packagist) Fixed in 5.0.6 Advisory →
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2 (Packagist) Fixed in 4.20.2 Advisory →
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2-legacy (Packagist) Fixed in 4.20.2 Advisory →
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2 (Packagist) Fixed in 4.19.3 Advisory →
  • Fix · GHSA-6929-8p9f-26jx simplesamlphp/saml2-legacy (Packagist) Fixed in 4.19.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49283
  2. 2026-10-03 Alias added: GHSA-6929-8p9f-26jx

References

Other 6

  • TI-2025-20553 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding CVSS 3.1HIGH 8.6
  • TI-2026-25110 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVSS 3.1HIGH 8.2
  • TI-2025-40522 SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout CVSS 3.1MEDIUM 6.1
  • TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
  • TI-2024-35256 SimpleSAMLphp xml-common XXE vulnerability CVSS 4.0HIGH 8.8
  • TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences