CVE-2026-49283: SimpleSAMLphp SAML2 Package Cross-IdP Authentication Bypass Vulnerability
Summary
CVE-2026-49283: SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass. Affects simplesamlphp/saml2 across 3 version ranges.
< 4.20.2
>= 5.0.0, < 5.0.6
>= 6.0.0, < 6.2.1
Fixed in 4.20.2, 5.0.6 or 6.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application that facilitates the implementation of SAML (Security Assertion Markup Language) for single sign-on (SSO) solutions. It allows service providers (SPs) to authenticate users through identity providers (IdPs). The SAML2 package is a core component that handles SAML assertions and responses. This vulnerability exposes the application to risks when handling unsigned SAML responses, particularly in multi-IdP environments.
Vulnerability Detail
The vulnerability arises from the HTTP-Artifact receive path in SimpleSAMLphp's SAML2 package, where an unsigned embedded SAML Response can be incorrectly validated as legitimate for a different IdP. The issue is rooted in the TLS validation process, where the SOAPClient's validateSSL method does not throw an exception for mismatched public keys. Consequently, an attacker can exploit this flaw to authenticate as users from a higher-trust IdP, leading to potential identity impersonation and unauthorized access.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.20.24.20.2composer require simplesamlphp/saml2:4.20.2 -
>= 5.0.0, < 5.0.65.0.6composer require simplesamlphp/saml2:5.0.6 -
>= 6.0.0, < 6.2.16.2.1composer require simplesamlphp/saml2:6.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional validation checks on the SAML responses received from IdPs. Ensure that only responses from trusted IdPs are processed and that they are properly signed. This can help mitigate the risk until the package is updated.
Conclusion
The CVE-2026-49283 vulnerability in the SimpleSAMLphp SAML2 package poses a significant risk in multi-IdP environments, allowing attackers to bypass authentication mechanisms. It is crucial to update to the latest patched versions of the package and implement additional validation measures to safeguard against potential exploits.
See every vulnerability recorded for simplesamlphp/saml2 →
FAQ
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
An attacker could authenticate as users from a higher-trust IdP, leading to unauthorized access and identity impersonation.
Yes, patched versions of the SimpleSAMLphp SAML2 package are available. Update to version 6.2.1 or later, 5.0.6 or later, or 4.20.2 or later.
If immediate updates are not possible, implement additional validation checks on SAML responses to mitigate risks until the update can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/saml2.
