Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2026-49283: SimpleSAMLphp lets untrusted IdP log in as others
CVE-2026-49283 · published 2 months ago
Summary
The SimpleSAMLphp SAML2 library could be tricked by a lower‑trust identity provider to accept an unsigned login response that appears to come from a trusted provider. This could allow attackers to log in users with fake credentials and control session data. Upgrade to the latest released version of SimpleSAMLphp to fix the issue.
What to do
- Update simplesamlphp saml2 to version 6.2.1.
- Update simplesamlphp saml2 to version 5.0.6.
- Update simplesamlphp saml2 to version 4.20.2.
- Update simplesamlphp saml2-legacy to version 4.20.2.
- Update simplesamlphp saml2 to version 4.19.3.
- Update simplesamlphp saml2-legacy to version 4.19.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | simplesamlphp | saml2 |
>= 6.0.0, < 6.2.1 >= 5.0.0, < 5.0.6 < 4.20.2 >= 4.20.0, < 4.20.2 < 4.19.3 Fix: upgrade to 6.2.1
|
| composer | simplesamlphp | saml2-legacy |
< 4.20.2 >= 4.20.0, < 4.20.2 < 4.19.3 Fix: upgrade to 4.20.2
|
| – | simplesamlphp | saml2 | < 4.19.3 |
| Ubuntu:16.04:LTS | canonical | simplesamlphp | All versions |
| Ubuntu:18.04:LTS | canonical | simplesamlphp | All versions |
| Ubuntu:20.04:LTS | canonical | simplesamlphp | All versions |
| Ubuntu:22.04:LTS | canonical | simplesamlphp | All versions |
| Ubuntu:24.04:LTS | canonical | simplesamlphp | All versions |
| Ubuntu:26.04:LTS | canonical | simplesamlphp | All versions |
| Debian:11 | debian | simplesamlphp | All versions |
| Debian:12 | debian | simplesamlphp | All versions |
| Debian:14 | debian | simplesamlphp | All versions |
Original advisory text
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.
References
- https://ubuntu.com/security/CVE-2026-49283 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-49283 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-49283 Vendor Advisory
- https://github.com/advisories/GHSA-6929-8p9f-26jx
- https://github.com/simplesamlphp/saml2/commit/e2df7992609964951b2a3e7d6566b7427b... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49283... Vendor Advisory
- https://github.com/simplesamlphp/saml2/security/advisories/GHSA-6929-8p9f-26jx Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-49283 Vendor Advisory
- https://github.com/simplesamlphp/saml2/commit/4a71b20d8d845579fd0a54d6449c265b40... Patch
- https://github.com/simplesamlphp/saml2/commit/a2c1ac588c70d7b7998546cf32675fb113... Patch
- https://github.com/simplesamlphp/saml2/commit/d5c213132ef671c0018a11252322034dbd... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-295Improper Certificate Validation
Timeline
Published19 Aug 2026
Updated4 Nov 2026
First seen2 Jul 2026
Sources
UBUNTU-CVE-2026-49283 · OSV
DEBIAN-CVE-2026-49283 · OSV
GHSA-6929-8p9f-26jx · GHSA
CVE-2026-49283 · NVD
CVE-2026-49283 · MITRE
CVE-2026-49283 · OSV
Track software like this
Free during beta