{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/saml2-library/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.3,"id":"CVE-2024-52806"},{"id":"CVE-2024-52596"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["SimpleSAMLphp","Saml2 Library"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","xxe","authentication"],"_cs_type":"advisory","_cs_vendors":["SimpleSAMLphp"],"content_html":"\u003cp\u003eSimpleSAMLphp and the associated Saml2 Library have been identified as vulnerable to a pre-authentication XML External Entity (XXE) injection vulnerability, tracked as CVE-2024-52806 and CVE-2024-52596. This critical flaw permits an unauthenticated remote attacker to send maliciously crafted XML payloads to the application, which the parser processes to read arbitrary files from the underlying server filesystem.\u003c/p\u003e\n\u003cp\u003eThe vulnerability carries a CVSS score of 8.8, reflecting the ease of exploitation (low attack complexity, no authentication, no user interaction required). The availability of a functional Python-based proof-of-concept exploit, published on August 12, 2026, significantly increases the risk of exploitation for organizations running unpatched versions of the SimpleSAMLphp framework or utilizing the affected Saml2 Library components. Defenders should prioritize patching or implementing protective measures to prevent unauthorized access to sensitive configuration and credential files typically stored on these servers.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized disclosure of sensitive server-side files, which may contain environment variables, encryption keys, application source code, or internal authentication credentials. This information disclosure can serve as a precursor to further system compromise, lateral movement, or full application takeover. All sectors utilizing SimpleSAMLphp for SAML identity federation are potentially exposed.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit web server logs for HTTP requests containing XML payloads targeting SimpleSAMLphp endpoints.\u003c/li\u003e\n\u003cli\u003eUpdate SimpleSAMLphp and the Saml2 Library to the latest patched versions provided by the vendor to remediate CVE-2024-52806 and CVE-2024-52596.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to detect and block incoming POST requests containing prohibited XML external entity definitions (e.g., \u0026lt;!ENTITY, SYSTEM, PUBLIC).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-12T13:20:35Z","date_published":"2026-08-12T13:20:35Z","id":"https://feed.craftedsignal.io/briefs/2026-08-simplesamlphp-xxe/","summary":"A proof-of-concept exploit has been published for a pre-authentication XML External Entity (XXE) vulnerability in SimpleSAMLphp and the Saml2 Library, enabling arbitrary file read by unauthenticated remote attackers.","title":"Pre-Authentication XXE Vulnerability in SimpleSAMLphp","url":"https://feed.craftedsignal.io/briefs/2026-08-simplesamlphp-xxe/"}],"language":"en","title":"CraftedSignal Threat Feed - Saml2 Library","version":"https://jsonfeed.org/version/1.1"}