Vulnerability in Simplesamlphp Xml-security
CVE-2026-32600
xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An atta…
EPSS: 0.000 (6.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Simplesamlphp Xml-security — versions >= 2.0.0, < 2.3.1, < 1.13.9
Weakness classification (CWE)
References
- https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p (x_refsource_CONFIRM)
- https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520 (x_refsource_MISC)
- https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-32600?
- CVE-2026-32600 is a high-severity vulnerability in Simplesamlphp Xml-security, classified under Improper Validation of Integrity Check Value. CVSS score: 8.2/10. Published 2026-03-13.
- How severe is CVE-2026-32600?
- High severity. CVSS v3 base score is 8.2 out of 10.