---
id: CVE-2026-49283
title: >-
  The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related
  functionality
summary: >-
  The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related
  functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the
  HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as
  cryptographically vali…
severity: high
cvss: 8.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-295
vendor: simplesamlphp
product: simplesamlphp/saml2
affected:
  - 'simplesamlphp/saml2 >= 6.0.0, < 6.2.1'
  - 'simplesamlphp/saml2 >= 5.0.0, < 5.0.6'
  - simplesamlphp/saml2 < 4.20.2
  - simplesamlphp/saml2-legacy < 4.20.2
patched:
  - simplesamlphp/saml2 6.2.1
  - simplesamlphp/saml2 5.0.6
  - simplesamlphp/saml2 4.20.2
  - simplesamlphp/saml2-legacy 4.20.2
published: '2026-08-19'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49283'
references:
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/4a71b20d8d845579fd0a54d6449c265b40db459d
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/a2c1ac588c70d7b7998546cf32675fb113f22a5f
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/d5c213132ef671c0018a11252322034dbddd735a
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/e2df7992609964951b2a3e7d6566b7427b2a968f
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/security/advisories/GHSA-6929-8p9f-26jx
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-6929-8p9f-26jx'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00472
epssPercentile: 0.38214
ecosystem: composer
ingestedAt: '2026-07-02T20:42:45.644Z'
---

## Overview

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49283)

Affected packages:

- `simplesamlphp/saml2 >= 6.0.0, < 6.2.1`
- `simplesamlphp/saml2 >= 5.0.0, < 5.0.6`
- `simplesamlphp/saml2 < 4.20.2`
- `simplesamlphp/saml2-legacy < 4.20.2`

Patched in:

- `simplesamlphp/saml2 6.2.1`
- `simplesamlphp/saml2 5.0.6`
- `simplesamlphp/saml2 4.20.2`
- `simplesamlphp/saml2-legacy 4.20.2`

Source: https://github.com/advisories/GHSA-6929-8p9f-26jx