The vulnerability carries a CVSS score of 8.8, reflecting the ease of exploitation (low attack complexity, no authentication, no user interaction required). The availability of a functional Python-based proof-of-concept exploit, published on August 12, 2026, significantly increases the risk of exploitation for organizations running unpatched versions of the SimpleSAMLphp framework or utilizing the affected Saml2 Library components. Defenders should prioritize patching or implementing protective measures to prevent unauthorized access to sensitive configuration and credential files typically stored on these servers.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive server-side files, which may contain environment variables, encryption keys, application source code, or internal authentication credentials. This information disclosure can serve as a precursor to further system compromise, lateral movement, or full application takeover. All sectors utilizing SimpleSAMLphp for SAML identity federation are potentially exposed.

Recommendation

• Immediately audit web server logs for HTTP requests containing XML payloads targeting SimpleSAMLphp endpoints.
• Update SimpleSAMLphp and the Saml2 Library to the latest patched versions provided by the vendor to remediate CVE-2024-52806 and CVE-2024-52596.
• Implement Web Application Firewall (WAF) rules to detect and block incoming POST requests containing prohibited XML external entity definitions (e.g., <!ENTITY, SYSTEM, PUBLIC).

Attack Chain

1. The attacker identifies a SimpleSAMLphp instance with the casserver module enabled and configured to use FileSystemTicketStore.
2. The attacker crafts a malicious CAS validation/proxy request containing a ticket or pgt parameter with a path traversal sequence (e.g., ../target.serialized).
3. The SimpleSAMLphp application receives the request and concatenates the attacker-controlled ticket parameter with the configured ticket directory.
4. The application attempts to read the file at the constructed path using getTicket(). Due to the path traversal, the file accessed is outside the intended ticket directory.
5. If the file contains valid serialized PHP data, the application unserializes its content.
6. In the CAS 1.0 validation flow, the application calls deleteTicket() with the same attacker-controlled path.
7. If the PHP process has sufficient permissions and the unserialized content meets certain criteria (e.g., an array or null), the target file is deleted.
8. The attacker achieves unauthorized file read and potentially deletion, impacting system integrity and confidentiality.

Impact

Successful exploitation of this vulnerability (CVE-2026-46491) allows remote attackers to bypass intended file access restrictions. Confirmed impacts include the ability to read and unserialize arbitrary files outside the designated ticket cache, potentially exposing sensitive data. Furthermore, under specific conditions within the CAS 1.0 validation flow, attackers can delete files outside the ticket cache, leading to denial-of-service or data loss scenarios. The severity of file deletion depends on the filesystem permissions of the PHP process and the content of the targeted file. This could potentially lead to destruction of CAS tickets, serialized SimpleSAMLphp runtime/cache files, or other writable files whose contents can be unserialized into a value accepted by the ?array return type.

Recommendation

• Upgrade the composer/simplesamlphp/simplesamlphp-module-casserver package to a version greater than 7.0.2 to remediate CVE-2026-46491.
• Implement input validation and sanitization on the ticket and pgt parameters to prevent path traversal attacks.
• Deploy the Sigma rule "Detect SimpleSAMLphp FileSystemTicketStore Path Traversal Attempt" to identify potential exploitation attempts.
• Review and restrict the filesystem permissions of the PHP process to minimize the impact of potential file deletion.