{"id":"CVE-2026-49283","title":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality","summary":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically vali…","severity":"high","cvss":8.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cwe":["CWE-295"],"vendor":"simplesamlphp","product":"simplesamlphp/saml2","affected":["simplesamlphp/saml2 >= 6.0.0, < 6.2.1","simplesamlphp/saml2 >= 5.0.0, < 5.0.6","simplesamlphp/saml2 < 4.20.2","simplesamlphp/saml2-legacy < 4.20.2"],"patched":["simplesamlphp/saml2 6.2.1","simplesamlphp/saml2 5.0.6","simplesamlphp/saml2 4.20.2","simplesamlphp/saml2-legacy 4.20.2"],"published":"2026-08-19","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-49283","references":[{"url":"https://github.com/simplesamlphp/saml2/commit/4a71b20d8d845579fd0a54d6449c265b40db459d","label":"security-advisories@github.com"},{"url":"https://github.com/simplesamlphp/saml2/commit/a2c1ac588c70d7b7998546cf32675fb113f22a5f","label":"security-advisories@github.com"},{"url":"https://github.com/simplesamlphp/saml2/commit/d5c213132ef671c0018a11252322034dbddd735a","label":"security-advisories@github.com"},{"url":"https://github.com/simplesamlphp/saml2/commit/e2df7992609964951b2a3e7d6566b7427b2a968f","label":"security-advisories@github.com"},{"url":"https://github.com/simplesamlphp/saml2/security/advisories/GHSA-6929-8p9f-26jx","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-6929-8p9f-26jx"}],"tags":["nvd","ghsa","composer"],"epss":0.00344,"epssPercentile":0.27924,"ecosystem":"composer","ingestedAt":"2026-07-02T20:42:45.644Z","slug":"CVE-2026-49283","body":"## Overview\n\nThe SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-49283)\n\nAffected packages:\n\n- `simplesamlphp/saml2 >= 6.0.0, < 6.2.1`\n- `simplesamlphp/saml2 >= 5.0.0, < 5.0.6`\n- `simplesamlphp/saml2 < 4.20.2`\n- `simplesamlphp/saml2-legacy < 4.20.2`\n\nPatched in:\n\n- `simplesamlphp/saml2 6.2.1`\n- `simplesamlphp/saml2 5.0.6`\n- `simplesamlphp/saml2 4.20.2`\n- `simplesamlphp/saml2-legacy 4.20.2`\n\nSource: https://github.com/advisories/GHSA-6929-8p9f-26jx","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}