---
id: CVE-2026-49289
title: >-
  The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related
  functionality
summary: >-
  The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related
  functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled
  XPath transforms while processing XML signatures in specially crafted SAML
  messages. XPath ev…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: simplesamlphp
product: simplesamlphp/saml2
affected:
  - simplesamlphp/saml2 <= 4.20.2
  - simplesamlphp/saml2-legacy <= 4.20.2
patched:
  - simplesamlphp/saml2 4.20.3
  - simplesamlphp/saml2-legacy 4.20.3
published: '2026-08-19'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T20:09:01.757'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49289'
references:
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/0043033891fdba9618386ab583e1d8afdf8aea6e
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/commit/6695eb923da491f716009c2a26b34a463ac05c6b
    label: security-advisories@github.com
  - url: >-
      https://github.com/simplesamlphp/saml2/security/advisories/GHSA-5cjr-mxj5-wmrx
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-5cjr-mxj5-wmrx'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00784
epssPercentile: 0.54107
ecosystem: composer
ingestedAt: '2026-07-02T20:42:45.640Z'
---

## Overview

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-49289)

Affected packages:

- `simplesamlphp/saml2 <= 4.20.2`
- `simplesamlphp/saml2-legacy <= 4.20.2`

Patched in:

- `simplesamlphp/saml2 4.20.3`
- `simplesamlphp/saml2-legacy 4.20.3`

Source: https://github.com/advisories/GHSA-5cjr-mxj5-wmrx