simplesamlphp SimpleSAMLphp

• CVE-2026-49284 High 7.1 SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo` 0.2%
• CVE-2020-5301 Low 3.0 Information disclosure of source code in SimpleSAMLphp 0.9%
• CVE-2020-5226 Medium 4.4 Cross-site scripting in SimpleSAMLphp 0.5%
• CVE-2020-5225 Medium 4.4 Log injection in SimpleSAMLphp 0.7%