Read the docs
TI-2026-36475 Aliases CVE-2026-49289GHSA-5cjr-mxj5-wmrx

SimpleSAMLphp SAML2: Possible DoS via XPath Transform

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00784 56th percentileScored 2026-11-07
Fix Fixed saml2 (simplesamlphp): 4.19.3, 4.20.3simplesamlphp/saml2 (Packagist): 4.20.3, 4.19.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
simplesamlphpsaml24.19.2 to before 4.19.3; 4.20.2 to before 4.20.34.19.3, 4.20.3Patch availableCNA
—simplesamlphp/saml2 (Packagist)4.20.0 to before 4.20.34.20.3Patch availableGHSA-5cjr-mxj5-wmrx
—simplesamlphp/saml2-legacy (Packagist)4.20.0 to before 4.20.34.20.3Patch availableGHSA-5cjr-mxj5-wmrx
—simplesamlphp/saml2 (Packagist)before 4.19.34.19.3Patch availableGHSA-5cjr-mxj5-wmrx
—simplesamlphp/saml2-legacy (Packagist)before 4.19.34.19.3Patch availableGHSA-5cjr-mxj5-wmrx
  • saml2 Vendorsimplesamlphp Affected 4.19.2 to before 4.19.3; 4.20.2 to before 4.20.3 Fixed in 4.19.3, 4.20.3 Patch available CNA
  • simplesamlphp/saml2 (Packagist) Vendor— Affected 4.20.0 to before 4.20.3 Fixed in 4.20.3 Patch available GHSA-5cjr-mxj5-wmrx
  • simplesamlphp/saml2-legacy (Packagist) Vendor— Affected 4.20.0 to before 4.20.3 Fixed in 4.20.3 Patch available GHSA-5cjr-mxj5-wmrx
  • simplesamlphp/saml2 (Packagist) Vendor— Affected before 4.19.3 Fixed in 4.19.3 Patch available GHSA-5cjr-mxj5-wmrx
  • simplesamlphp/saml2-legacy (Packagist) Vendor— Affected before 4.19.3 Fixed in 4.19.3 Patch available GHSA-5cjr-mxj5-wmrx

Remediation

  • Fix · CNA saml2 (simplesamlphp) Fixed in 4.19.3, 4.20.3
  • Fix · GHSA-5cjr-mxj5-wmrx simplesamlphp/saml2 (Packagist) Fixed in 4.20.3 Advisory →
  • Fix · GHSA-5cjr-mxj5-wmrx simplesamlphp/saml2-legacy (Packagist) Fixed in 4.20.3 Advisory →
  • Fix · GHSA-5cjr-mxj5-wmrx simplesamlphp/saml2 (Packagist) Fixed in 4.19.3 Advisory →
  • Fix · GHSA-5cjr-mxj5-wmrx simplesamlphp/saml2-legacy (Packagist) Fixed in 4.19.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49289
  2. 2026-10-03 Alias added: GHSA-5cjr-mxj5-wmrx

References

Other 4

  • TI-2025-20553 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding CVSS 3.1HIGH 8.6
  • TI-2026-25110 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption CVSS 3.1HIGH 8.2
  • TI-2025-40522 SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout CVSS 3.1MEDIUM 6.1
  • TI-2018-04801 The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which… CVSS 3.0CRITICAL 9.8
  • TI-2024-35256 SimpleSAMLphp xml-common XXE vulnerability CVSS 4.0HIGH 8.8
  • TI-2017-09530 The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and… CVSS 3.0CRITICAL 9.8
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences