Signature Confusion Vulnerability in SimpleSAMLphp SAML2 Library
Summary
CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Affects simplesamlphp across 2 version ranges.
< 1.19.0-1+deb11u2
< 7867d6099dc7f31bed1ea10e5bea159c5623d2a0
Fixed in 1.19.0-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
SimpleSAMLphp is a widely used PHP library that provides SAML2 related functionality, enabling secure authentication and authorization for web applications. It is designed to facilitate Single Sign-On (SSO) and supports various identity providers. However, prior to versions 4.17.0 and 5.0.0-alpha.20, the library is susceptible to a signature confusion attack in the HTTP-Redirect binding, which can compromise the integrity of SAML messages.
Vulnerability Detail
The vulnerability arises from a flaw in the HTTP-Redirect binding of the SimpleSAMLphp SAML2 library, where an attacker can exploit the acceptance of signed SAMLResponses to trick the application into accepting an unsigned message. This could lead to unauthorized access or data breaches, as the application may process malicious requests as legitimate. The issue is critical as it undermines the trust model of SAML authentication.
How To Fix
Minimum fixed version
1.19.0-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade simplesamlphpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate upgrading is not feasible, consider implementing additional validation checks on SAML messages to ensure they are properly signed before processing. However, this is not a substitute for upgrading the package.
Conclusion
The SimpleSAMLphp SAML2 library has a critical vulnerability that can be exploited through a signature confusion attack. It is crucial for users to update to the latest versions to protect their applications from potential security breaches. Implementing the recommended fixes and utilizing tools like Vulert can enhance the security posture of your applications.
See every vulnerability recorded for simplesamlphp →
FAQ
The vulnerability is a signature confusion attack that allows an attacker to send an unsigned SAML message that the application may accept as valid.
Versions prior to 4.17.0 and 5.0.0-alpha.20 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access to sensitive information and compromise the security of user sessions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for simplesamlphp.
