simplesamlphp vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20203
3. 20233
4. 20242
5. 20251
6. 20266

Newest CVEs

• CVE-2026-49289

  SimpleSAMLphp SAML2: Possible DoS via XPath Transform

  simplesamlphp · saml2

  High7.5
• CVE-2026-49283

  SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

  simplesamlphp · saml2

  High8.7
• CVE-2026-49284

  SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

  simplesamlphp · simplesamlphp

  High7.1
• CVE-2026-46491

  SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion

  simplesamlphp · simplesamlphp-module-casserver

  High8.6
• CVE-2025-65954

  SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout

  simplesamlphp · simplesamlphp-module-casserver

  Medium4.7
• CVE-2026-32600

  xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption

  simplesamlphp · xml-security

  High8.2
• CVE-2025-27773

  SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding

  simplesamlphp · saml2

  High8.6
• CVE-2024-52596

  SimpleSAMLphp xml-common XXE vulnerability

  simplesamlphp · xml-common

  High8.8
• CVE-2024-52806

  SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

  simplesamlphp · saml2

  High8.3
• CVE-2023-49087

  Validation of SignedInfo

  simplesamlphp · xml-security

  Medium6.8