simplesamlphp/simplesamlphp vulnerabilities

CVEs whose affected-version data names the simplesamlphp/simplesamlphp package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-49284High· 7.1

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

▾ Twilightsimplesamlphp · simplesamlphp/simplesamlphpEPSS 0.22%via GHSA

simplesamlphp/simplesamlphp vulnerabilities (CVEs) · VulnSea