CVE Feed

    Dashboard / CVE / CVE-2026-49284

    CVE-2026-49284

    SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.

    Published:Jul 17, 2026
    Last Modified:Jul 20, 2026
    EPS:Jul 17, 2026
    EPSS Score:0.00229
    CVSS Score:7.1

    Affected Products

    Vendor
    Simplesamlphp
    Product
    Simplesamlphp

    Exploits

    No exploit reference

    Related CVEs

    CVE-2020-5301 (CVSS 3) — SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in…
    CVE-2020-5226 (CVSS 4.4) — Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error report…
    CVE-2020-5225 (CVSS 4.4) — Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error repo…
    CVE-2019-3465 (CVSS 8.8) — Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorre…
    CVE-2011-4625 (CVSS 7.5) — simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could all…
    CVE-2018-7711 (CVSS 8.1) — HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values i…
    CVE-2018-7644 (CVSS 7.5) — The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signat…
    CVE-2017-18122 (CVSS 8.1) — A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service P…
    CVE-2017-18121 (CVSS 6.1) — The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allow…
    CVE-2018-6521 (CVSS 9.8) — The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries up…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High