CVE-2025-27773: SimpleSAMLphp SAML2 Library Signature Verification Flaw
Summary
CVE-2025-27773: The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding. Affects simplesamlphp/saml2 across 2 version ranges.
< 4.17.0
>= 5.0.0-alpha.1, < 5.0.0-alpha.20
Fixed in 4.17.0 or 5.0.0-alpha.20, depending on the release line you run. How to fix ↓
Also tracked for
- simplesamlphp · Debian:11
The same CVE-2025-27773 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The SimpleSAMLphp SAML2 library is an open-source implementation of the SAML (Security Assertion Markup Language) protocol, which facilitates single sign-on (SSO) for web applications. It is widely used for enabling secure authentication and authorization between identity providers (IdPs) and service providers (SPs). This library is designed to handle SAML requests and responses, ensuring secure communication between parties. However, a critical vulnerability has been identified in version 4 of the library, which compromises its signature verification process, potentially allowing attackers to exploit this flaw.
Vulnerability Detail
The vulnerability arises from a signature confusion attack in the HTTP-Redirect binding of the SimpleSAMLphp SAML2 library. An attacker can manipulate signed SAML responses to trick the application into accepting an unsigned message. Specifically, the library incorrectly verifies signatures by processing parameters in a way that allows an attacker to substitute an unverified SAMLRequest with a valid SAMLResponse. This flaw can lead to unauthorized access and impersonation of users within the service provider, as the application may accept malicious requests as legitimate.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.17.04.17.0composer require simplesamlphp/saml2:4.17.0 -
>= 5.0.0-alpha.1, < 5.0.0-alpha.205.0.0-alpha.20composer require simplesamlphp/saml2:5.0.0-alpha.20
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not process SAMLRequest parameters that could be manipulated. Implement additional validation checks to verify the integrity of incoming SAML messages before processing them.
Conclusion
The SimpleSAMLphp SAML2 library has a critical vulnerability that can lead to serious security risks, including unauthorized access and user impersonation. It is crucial to update to the patched versions to mitigate these risks and ensure the integrity of your application.
See every vulnerability recorded for simplesamlphp/saml2 →
FAQ
CVE-2025-27773 is a vulnerability in the SimpleSAMLphp SAML2 library that allows attackers to exploit signature verification flaws in the HTTP-Redirect binding.
This vulnerability can allow attackers to impersonate users by sending malicious SAML requests that the application may accept as legitimate, leading to unauthorized access.
Versions 4.6.15 and earlier, as well as versions 5.0.0-alpha.19 and earlier, are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/saml2.
