CVE-2026-49284
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Information disclosure vulnerability in SimpleSAMLphp before 1.18.6 and in versions 2.x before 2.4.7 and 2.5.2. An attacker can exploit missing InResponseTo validation in signed assertions to bind a response from one trusted IdP to SP state created for another IdP, bypassing routing mechanisms.
Risk Assessment
Risk of bypassing access controls and redirecting users to an incorrect IdP, potentially leading to unauthorized access.
Recommendation
Update SimpleSAMLphp to version 2.4.7, 2.5.2, or later. Implement appropriate safeguards for SP-initiated login flows.
Other vulnerabilities in SimpleSAMLphp
See all- CVE-2017-12869High
The multiauth module in SimpleSAMLphp version 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php due to improper validation of user input.
- CVE-2017-12873Critical
SimpleSAMLphp versions 1.7.0 through 1.14.10 may allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
- CVE-2017-12868Critical
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp version 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication due to missing character conversions before an XOR operation.
Original NVD description (English source)
SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.