Vulnerabilities

TI-2026-24841 CVE-2026-32313 · GHSA-4v26-v6cg-g6f9

xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

HIGH 75

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00158 Published 2026-03-13 Fixed in 3.1.5 CWE-354

TI-2025-40988 CVE-2025-66578 · GHSA-c4cc-x928-vjw9

robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

LOW 32

xmlseclibs is a library written in PHP for working with XML Encryption and Signatures.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0024 Published 2025-12-09 Fixed in 3.1.4 CWE-248

TI-2019-02593 CVE-2019-3465 · GHSA-pqm6-cgwr-x6pf

Improper signature verification in Rob Richards XmlSecLibs

MEDIUM 43

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate o…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02988 Published 2019-11-07 Fixed in 3.0.4, 2.1.1 CWE-347

Vulnerabilities

Filters

xmlseclibs is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

robrichards/xmlseclibs has an Libxml2 Canonicalization error which can bypass Digest/Signature validation

Improper signature verification in Rob Richards XmlSecLibs