Simplesamlphp vulnerabilities
We track 9 vulnerabilities in Simplesamlphp products across 5 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on August 19, 2026.
Latest Simplesamlphp vulnerabilities
- 7.5 High severity
saml2: Uncontrolled Resource Consumption
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume un
- 8.7 High severity
saml2: Improper Certificate Validation
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identit
- 7.1 High severity
simplesamlphp: Insufficient Verification of Data Authenticity
SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a
- 8.6 High severity
simplesamlphp-module-casserver: Improper Limitation of a Pathname to a Restricted Directory
SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths for the file-based CAS ticket store by directly concatenating the configured ticke
- 8.2 High severity
xml-security: Improper Validation of Integrity Check Value
xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can use this to
- 8.6 High severity
saml2: Improper Verification of Cryptographic Signature
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect bin
- 8.3 High severity
saml2: Improper Restriction of XML External Entity Reference
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
- 8.8 High severity
xml-common: Improper Restriction of XML External Entity Reference
SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.
- 7.5 High severity
xml-security: Insufficient Verification of Data Authenticity
xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the