Shibboleth vulnerabilities
We track 5 vulnerabilities in Shibboleth products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2026.
Latest Shibboleth vulnerabilities
- 8.1 High severity
Shibboleth: Improper Authentication
The Shibboleth WordPress plugin before 2.5.4 does not fail closed when its HTTP header identity mode is enabled without an anti-spoofing key, treating any request that carries identity headers as an authenticated session without verifying them. On a deployment
- 9.1 Critical severity
Service Provider: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this is
- 7.5 High severity
Xmltooling: Server-Side Request Forgery
Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.)
- 7.3 High severity
Service Provider: Uncontrolled Search Path Element
Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in the service executable's folder. This occurs because the ins
- 8.2 High severity
Oidc Op: Server-Side Request Forgery
The OIDC OP plugin before 3.0.4 for Shibboleth Identity Provider allows server-side request forgery (SSRF) due to insufficient restriction of the request_uri parameter. This allows attackers to interact with arbitrary third-party HTTP services.