Log in Start free

Vulnerability · Published Aug 19, 2026 · Assigned by GitHub_M

CVE-2026-49283SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

High 8.7

In plain English

A high-severity improper certificate validation in saml2 from simplesamlphp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High
Exploit odds (30 days)0.5%top 59.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12simplesamlphpno fix listedDEBIAN-CVE-2026-49283
Debian:14simplesamlphpno fix listedDEBIAN-CVE-2026-49283
Packagistsimplesamlphp/saml24.20.2GHSA-6929-8p9f-26jx
Packagistsimplesamlphp/saml25.0.6GHSA-6929-8p9f-26jx
Packagistsimplesamlphp/saml24.19.3GHSA-6929-8p9f-26jx
Packagistsimplesamlphp/saml26.2.1GHSA-6929-8p9f-26jx
Packagistsimplesamlphp/saml2-legacy4.19.3GHSA-6929-8p9f-26jx
Packagistsimplesamlphp/saml2-legacy4.20.2GHSA-6929-8p9f-26jx
Ubuntu:24.04:LTSsimplesamlphpno fix listedUBUNTU-CVE-2026-49283
Ubuntu:26.04:LTSsimplesamlphpno fix listedUBUNTU-CVE-2026-49283
Ubuntu:26.10simplesamlphpno fix listedUBUNTU-CVE-2026-49283

Affected products (as reported)

VendorProductVersions
simplesamlphp saml2 < 4.19.3>= 4.20.0, < 4.20.2>= 5.0.0, < 5.0.6>= 6.0.0, < 6.2.1

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

References