Log in Start free

simplesamlphp

Products

ProductCVEsExploitedLatest
saml24–Aug 19, 2026
SimpleSAMLphp4–Jul 17, 2026
simplesamlphp-module-casserver2–Jun 9, 2026
xml-security2–Mar 13, 2026
xml-common1–Dec 2, 2024

Exploited and recent CVEs

  • CVE-2026-49289 High 7.5 SimpleSAMLphp SAML2: Possible DoS via XPath Transform 0.8%
  • CVE-2026-49283 High 8.7 SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass 0.5%
  • CVE-2026-49284 High 7.1 SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` 0.2%
  • CVE-2026-46491 High 8.6 SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion 0.4%
  • CVE-2025-65954 Medium 4.7 SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout 0.3%
  • CVE-2026-32600 High 8.2 xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption 0.2%
  • CVE-2025-27773 High 8.6 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding 0.4%
  • CVE-2024-52596 High 8.8 SimpleSAMLphp xml-common XXE vulnerability 1.0%
  • CVE-2024-52806 High 8.3 SimpleSAMLphp SAML2 has an XXE in parsing SAML messages 0.4%
  • CVE-2023-49087 Medium 6.8 Validation of SignedInfo 0.2%
  • CVE-2020-5301 Low 3.0 Information disclosure of source code in SimpleSAMLphp 0.9%
  • CVE-2020-5226 Medium 4.4 Cross-site scripting in SimpleSAMLphp 0.5%
  • CVE-2020-5225 Medium 4.4 Log injection in SimpleSAMLphp 0.7%