OpenSAML C++ Library Vulnerability: Forging of Signed SAML Messages
Summary
CVE-2025-31335: The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures). Affects opensaml versions < 3.2.0-2+deb11u1. Fixed in 3.2.0-2+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenSAML C++ library is a widely used toolkit for implementing Security Assertion Markup Language (SAML) protocols, which facilitate secure web-based communication and authentication. It provides developers with the necessary tools to create, parse, and validate SAML messages. However, prior to version 3.3.1, the library was susceptible to a vulnerability that allowed attackers to forge signed SAML messages through parameter manipulation, particularly when using SAML bindings that rely on non-XML signatures.
Vulnerability Detail
The vulnerability identified as CVE-2025-31335 arises from improper handling of parameters in the OpenSAML C++ library, which can lead to the forging of signed SAML messages. This issue can have serious implications, including unauthorized access to systems that rely on SAML for authentication and data exchange. Attackers could exploit this vulnerability to impersonate users or manipulate authentication flows, potentially leading to data breaches or unauthorized actions within affected applications.
How To Fix
Minimum fixed version
3.2.0-2+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensamlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the use of non-XML signatures in SAML bindings until the library can be updated. This may involve modifying configuration settings in your application to ensure that only XML signatures are utilized.
Conclusion
The OpenSAML C++ library vulnerability CVE-2025-31335 poses a significant risk to applications relying on SAML for secure communication. It is crucial to update to the patched versions provided for different Debian ecosystems to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for opensaml →
FAQ
CVE-2025-31335 is a vulnerability in the OpenSAML C++ library that allows attackers to forge signed SAML messages through parameter manipulation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring access to the code.
The vulnerability can lead to unauthorized access, impersonation of users, and manipulation of authentication flows, resulting in data breaches or unauthorized actions.
You can update the OpenSAML library using package management commands specific to your Debian version, as detailed in the 'how to fix' section.
Yes, you can temporarily disable the use of non-XML signatures in SAML bindings as a workaround until the library is updated.
Related vulnerabilities
Recent vulnerabilities recorded for opensaml.
