CVE-2026-49289: Denial-of-Service Vulnerability in SimpleSAMLphp SAML2 Library
Summary
CVE-2026-49289: SimpleSAMLphp has Possible DoS via XPath Transform. Affects simplesamlphp/saml2 versions < 4.20.3. Fixed in 4.20.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is an open-source application written in PHP that facilitates SAML (Security Assertion Markup Language) authentication. It is widely used for enabling single sign-on (SSO) capabilities across various web applications. The library provides a robust framework for managing SAML assertions and responses, but it has been found vulnerable to Denial-of-Service (DoS) attacks due to its handling of XPath transforms.
Vulnerability Detail
The vulnerability arises from the library's inadequate restrictions on XPath transforms, allowing attackers to send specially crafted messages that exploit this weakness. This can lead to a Denial-of-Service condition, where the affected system becomes unresponsive or crashes, impacting availability. The vulnerability is classified under CWE-400, indicating that it can lead to resource exhaustion. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
4.20.3
This is the first release that contains the fix.
composer require simplesamlphp/saml2:4.20.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict the use of XPath transforms in their configurations until they can apply the patch. This may involve modifying the library's settings to disallow XPath transforms entirely.
Conclusion
The SimpleSAMLphp SAML2 library is vulnerable to Denial-of-Service attacks due to improper handling of XPath transforms. Users are strongly advised to update to version 4.20.3 or later to mitigate this risk. Additionally, temporary workarounds can be implemented to restrict XPath transforms until the update is applied.
See every vulnerability recorded for simplesamlphp/saml2 →
FAQ
The vulnerability allows for Denial-of-Service attacks via unregulated XPath transforms in the SimpleSAMLphp SAML2 library.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
An attacker can exploit this vulnerability to send crafted messages that may cause the application to become unresponsive, leading to service downtime.
Yes, a patch is available in version 4.20.3 of the affected packages. Users should update to this version or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp/saml2.
