SimpleSAMLphp - CraftedSignal Threat Feed

SimpleSAMLphp HTTP-Artifact Authentication Bypass via TLS Validator Confusion (CVE-2026-49283)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:27:06 +0000

A critical vulnerability (CVE-2026-49283) in SimpleSAMLphp's HTTP-Artifact receive path allows a malicious or lower-trust Identity Provider (IdP) to bypass authentication and impersonate users from a higher-trust IdP. This flaw, present in versions < 4.20.2, >= 5.0.0 < 5.0.6, and >= 6.0.0 < 6.2.1 of the saml2 and saml2-legacy packages, occurs because the SOAPClient::validateSSL() method fails to throw an exception when the TLS public key does not match, causing SAML2\Message::validate() to incorrectly deem an unsigned embedded SAML Response as cryptographically valid. This enables the attacker to forge assertion attributes, NameID, and session data, effectively authenticating as arbitrary users from a high-assurance IdP within a multi-IdP or federation deployment. For defenders, this means a compromised or untrusted IdP within their trust circle could gain unauthorized access to Service Providers, violating trust boundaries and leading to significant data breaches or unauthorized system access.

Attack Chain

A malicious or lower-trust Identity Provider (IdP) crafts an unsigned SAML Response that claims to be issued by a high-trust IdP.
The malicious IdP sends an HTTP-Artifact Response containing this forged SAML Response to the Service Provider (SP).
The SP's SimpleSAMLphp installation receives the HTTP-Artifact Response and initiates its HTTPArtifact::receive() processing flow.
During processing of the ArtifactResponse, the SOAPClient::addSSLValidator() mechanism is invoked, providing a TLS-based validator for the outer SOAP message.
The embedded unsigned SAML Response is then passed to SAML2\Message::validate(), which delegates signature validation to the validator provided by the outer ArtifactResponse.
The SOAPClient::validateSSL() method, when called to validate the embedded SAML Response, returns normally even though the TLS public key does not match the key for the claimed high-trust IdP.
Because SOAPClient::validateSSL() did not throw an exception, SAML2\Message::validate() incorrectly interprets this as successful validation, treating the unsigned embedded SAML Response as cryptographically valid.
The SP then processes this maliciously validated SAML Response using metadata from the claimed high-trust IdP, granting the attacker authentication as arbitrary users from that IdP.

Impact

This vulnerability allows a malicious or lower-trust IdP within the same SP/federation trust set to authenticate to the Service Provider (SP) as arbitrary users from any higher-trust IdP when the HTTP-Artifact binding is in use. Attackers can choose and forge assertion attributes, NameID, and session data within the unsigned assertion, gaining unauthorized access as legitimate users. This represents a severe authentication bypass and identity-provider impersonation issue, fundamentally undermining the security boundaries in federated environments where the integrity of different IdPs is critical. If exploited, it could lead to widespread unauthorized access, data exfiltration, or further compromise of systems relying on the affected SimpleSAMLphp instances.

Recommendation

Patch CVE-2026-49283 by updating SimpleSAMLphp to a non-vulnerable version immediately:
- composer/simplesamlphp/saml2: Upgrade to 6.2.1 or later.
- composer/simplesamlphp/saml2: Upgrade to 5.0.6 or later for version 5.x branch.
- composer/simplesamlphp/saml2 or composer/simplesamlphp/saml2-legacy: Upgrade to 4.20.2 or later for version 4.x branch.
Review authentication logs for unusual login patterns or failed authentications originating from specific IdPs, especially if using HTTP-Artifact binding.

SimpleSAMLphp Vulnerable to Denial-of-Service via Malicious XPath Transform

hello@craftedsignal.io — Fri, 03 Jul 2026 11:25:05 +0000

SimpleSAMLphp, a widely used open-source PHP application for SAML 2.0 service providers and identity providers, along with its underlying SAML2 library (composer/simplesamlphp/saml2 and composer/simplesamlphp/saml2-legacy), was found to be vulnerable to a Denial-of-Service (DoS) attack, tracked as CVE-2026-49289. The vulnerability, identified on or before July 2, 2026, arises from its handling of XPath transforms within SAML messages. Attackers can craft malicious SAML messages that, when processed by a vulnerable SimpleSAMLphp instance, cause resource exhaustion and lead to service interruption. This impacts any entity relying on these components and necessitates immediate updates to mitigate the risk of service disruption. A mitigation has been implemented in later versions (beyond 4.20.2) to restrict the number of transforms and disallow XPath transforms explicitly.

Attack Chain

An attacker identifies a target entity relying on SimpleSAMLphp for SAML processing.
The attacker crafts a specially designed SAML message incorporating complex or excessive XPath transforms.
The malicious SAML message is sent to the vulnerable SimpleSAMLphp instance, typically via an unauthenticated or authenticated SAML request/response endpoint.
The SimpleSAMLphp application receives and begins parsing the incoming SAML message, including its XPath transforms.
During the processing of the XPath transforms, the application consumes excessive system resources (CPU, memory).
Due to resource exhaustion, the SimpleSAMLphp instance becomes unresponsive or crashes, leading to a Denial-of-Service for legitimate users.

Impact

Successful exploitation of CVE-2026-49289 allows an attacker to render any entity relying on SimpleSAMLphp or the SAML2 library (versions <= 4.20.2) unavailable. This directly impacts the ability of legitimate users to authenticate or access services protected by SimpleSAMLphp, leading to significant operational disruption, reputational damage, and potential financial losses for affected organizations. The vulnerability affects critical authentication infrastructure, making it a high-priority concern for any organization utilizing SimpleSAMLphp.

Recommendation

Patch CVE-2026-49289 by upgrading composer/simplesamlphp/saml2 and composer/simplesamlphp/saml2-legacy to versions greater than 4.20.2 immediately.
Review the mitigation details provided in the GHSA-5cjr-mxj5-wmrx advisory for specific implementation guidance.

SimpleSAMLphp SP IdP Bypass Vulnerability (CVE-2026-49284)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:11:00 +0000

A vulnerability (CVE-2026-49284) has been identified in SimpleSAMLphp affecting versions up to 2.4.6 and between 2.5.0 and 2.5.1. This flaw stems from the Service Provider (SP) failing to enforce the intended Identity Provider (IdP) during an SP-initiated login, particularly in multi-IdP environments. Specifically, if a saved SP state expects a response from IdP A, but the Assertion Consumer Service (ACS) receives a valid SAML response from a different IdP (IdP B), SimpleSAMLphp logs a warning but proceeds to process the response. This behavior is critical when combined with the SP's handling of unsigned samlp:Response/@InResponseTo elements outside of signed assertions, especially if the signed assertion's SubjectConfirmationData lacks its own InResponseTo. This combination allows an attacker to bind a response from a trusted, but potentially lower-trust, IdP to SP state originally created for a higher-trust IdP, leading to authentication and authorization bypasses.

Attack Chain

Initial Access / User Impersonation: A legitimate user initiates an SP-initiated SAML login request to a SimpleSAMLphp SP, which expects authentication from a specific high-trust IdP (IdP A).
Attacker Intercepts/Manipulates Flow: An attacker manipulates the SAML exchange, potentially redirecting the user or crafting a SAML response from a trusted, but lower-assurance, IdP (IdP B) that the SP also trusts.
Crafted SAML Response: The attacker generates a SAML response from IdP B. This response contains a valid, signed assertion but deliberately omits the InResponseTo attribute within SubjectConfirmationData.
Unsigned Response-Level InResponseTo: The attacker also includes an unsigned samlp:Response/@InResponseTo attribute in the overall SAML response, which matches the expected value from the SP-initiated request.
SimpleSAMLphp Processing Flaw: The SimpleSAMLphp SP receives this crafted SAML response. Despite the ExpectedIssuer in its saved state pointing to IdP A, it processes the response from IdP B because the assertion is validly signed and the InResponseTo checks are bypassed by the combination of missing SubjectConfirmationData/InResponseTo and unsigned Response/InResponseTo.
IdP Mismatch Ignored: The SP issues a warning about the IdP mismatch but continues processing, accepting the authentication from IdP B.
Authentication/Authorization Bypass: The user is authenticated by the SP as if they had logged in via IdP A, potentially bypassing intended authorization checks or gaining access with different trust levels than expected.
Unauthorized Access / Privilege Escalation: If the application's authorization relies on the specific IdP used for login or its associated trust level, the attacker achieves unauthorized access or privilege escalation within the application.

Impact

This vulnerability significantly impacts deployments where SimpleSAMLphp functions as a Service Provider (SP) and trusts multiple Identity Providers (IdPs) with varying levels of assurance, different tenant boundaries, or distinct attribute namespaces. The primary consequence is an authentication and authorization bypass, enabling a lower-trust IdP to satisfy SP state created for a higher-trust or specific expected IdP. This can subvert security mechanisms designed to route users to particular IdPs, including configurations with enable_unsolicited set to false. Attackers could gain unauthorized access or escalate privileges within the application if authorization decisions are tied to the selected IdP or its trust context. The severity of the impact is contingent on the attacker's ability to obtain signed IdP-initiated assertions from a trusted, but less secure, IdP and how application authorization maps user identifiers.

Recommendation

Upgrade SimpleSAMLphp to a patched version immediately to remediate CVE-2026-49284.
Review your SimpleSAMLphp sp-remote configurations for any multi-IdP deployments that might be affected by CVE-2026-49284.