Vulnerability Database · Packagist · simplesamlphp/saml2 · Version
simplesamlphp/saml2 v3.1.6
v3.1.6 is affected by 6 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 0 High 5 Medium 1 Low 0 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
simplesamlphp/saml2 v3.1.6 vulnerabilities
6 vulnerabilities cover simplesamlphp/saml2 v3.1.6. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2025-27773: SimpleSAMLphp SAML2 Library Signature Verification Flaw | 8.6 high | 4.17.0 | 11 Mar 2025 |
| CVE-2024-52806: SimpleSAMLphp SAML2 XXE Vulnerability in XML Parsing | 8.3 medium | 4.6.14 | 02 Dec 2024 |
| CVE-2018-7711: SimpleSAMLphp saml2 incorrect signature validation | 8.1 high | 1.10.6 | 14 May 2022 |
| CVE-2026-49289: Denial-of-Service Vulnerability in SimpleSAMLphp SAML2 Library | 7.5 high | 4.20.3 | 02 Jul 2026 |
| CVE-2018-6519: SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability | 7.5 high | 1.10.4 | 14 May 2022 |
| CVE-2018-7644: SimpleSAMLphp Improper Verification of Cryptographic Signature | 7.5 high | 1.10.5 | 13 May 2022 |
Looking for another version, or everything Vulert holds for simplesamlphp/saml2?
Questions
About simplesamlphp/saml2 v3.1.6
Is simplesamlphp/saml2 v3.1.6 vulnerable?
Yes. 6 vulnerabilities in the Vulert database cover simplesamlphp/saml2 v3.1.6: 0 critical, 5 high, 1 medium and 0 low. Each entry above names the fixed version to move to.
How do I monitor simplesamlphp/saml2 for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the simplesamlphp/saml2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.