Pre-Authentication XXE Vulnerability in SimpleSAMLphp

SimpleSAMLphp and the associated Saml2 Library have been identified as vulnerable to a pre-authentication XML External Entity (XXE) injection vulnerability, tracked as CVE-2024-52806 and CVE-2024-52596. This critical flaw permits an unauthenticated remote attacker to send maliciously crafted XML payloads to the application, which the parser processes to read arbitrary files from the underlying server filesystem.

The vulnerability carries a CVSS score of 8.8, reflecting the ease of exploitation (low attack complexity, no authentication, no user interaction required). The availability of a functional Python-based proof-of-concept exploit, published on August 12, 2026, significantly increases the risk of exploitation for organizations running unpatched versions of the SimpleSAMLphp framework or utilizing the affected Saml2 Library components. Defenders should prioritize patching or implementing protective measures to prevent unauthorized access to sensitive configuration and credential files typically stored on these servers.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive server-side files, which may contain environment variables, encryption keys, application source code, or internal authentication credentials. This information disclosure can serve as a precursor to further system compromise, lateral movement, or full application takeover. All sectors utilizing SimpleSAMLphp for SAML identity federation are potentially exposed.

Recommendation

• Immediately audit web server logs for HTTP requests containing XML payloads targeting SimpleSAMLphp endpoints.
• Update SimpleSAMLphp and the Saml2 Library to the latest patched versions provided by the vendor to remediate CVE-2024-52806 and CVE-2024-52596.
• Implement Web Application Firewall (WAF) rules to detect and block incoming POST requests containing prohibited XML external entity definitions (e.g., <!ENTITY, SYSTEM, PUBLIC).