Simplesamlphp
33 CVEs across 11 Simplesamlphp products. Browse Simplesamlphp vulnerabilities, severities, and proof-of-concept exploits.
Simplesamlphp products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-49284 | High | 7.1 | 2026-07-17 | SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enfor… |
CVE-2026-46491 | High | 8.6 | 2026-06-10 | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver… |
CVE-2025-65954 | Medium | 6.1 | 2026-05-18 | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0, the logout endpoint… |
CVE-2026-32600 | High | 8.2 | 2026-03-16 | xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-1… |
CVE-2025-27773 | High | 8.6 | 2025-03-11 | The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion a… |
CVE-2024-52806 | High | 8.3 | 2024-12-02 | SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's poss… |
CVE-2024-52596 | | 2024-12-02 | SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible… | |
CVE-2023-49087 | Medium | 6.8 | 2023-11-30 | xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the relate… |
CVE-2010-10008 | Low | 3.5 | 2023-01-17 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been declared as problematic… |
CVE-2010-10004 | Low | 3.5 | 2023-01-09 | A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown processing. The manipulat… |
CVE-2010-10002 | Low | 3.1 | 2023-01-01 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown f… |
CVE-2020-5301 | Low | 3.0 | 2020-04-21 | SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. The module controller in `SimpleSAML\Module` that processes requests for… |
CVE-2020-5226 | Medium | 4.4 | 2020-01-24 | Cross-site scripting in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script allows error reports to be submitted and sent to the system administ… |
CVE-2020-5225 | Medium | 4.4 | 2020-01-24 | Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system admini… |
CVE-2019-3465 | High | 8.8 | 2019-11-07 | Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML… |
CVE-2011-4625 | High | 7.5 | 2019-11-06 | simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages. |
CVE-2018-7711 | High | 8.1 | 2018-03-05 | HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an… |
CVE-2018-7644 | High | 7.5 | 2018-03-05 | The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attack… |
CVE-2017-18122 | High | 8.1 | 2018-02-02 | A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any u… |
CVE-2017-18121 | Medium | 6.1 | 2018-02-02 | The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute… |
CVE-2018-6521 | Critical | 9.8 | 2018-02-02 | The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might… |
CVE-2018-6520 | Medium | 6.1 | 2018-02-02 | SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL. |
CVE-2018-6519 | High | 7.5 | 2018-02-02 | The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-… |
CVE-2017-12874 | High | 7.5 | 2017-09-01 | The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation util… |
CVE-2017-12873 | Critical | 9.8 | 2017-09-01 | SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by lever… |
CVE-2017-12872 | Medium | 5.9 | 2017-09-01 | The (1) Htpasswd authentication source in the authcrypt module and (2) SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to… |
CVE-2017-12871 | Medium | 5.9 | 2017-09-01 | The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the… |
CVE-2017-12870 | Medium | 5.9 | 2017-09-01 | SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-the-middle attackers to obtain sensitive information by leveraging use of the aesEncrypt and aesDec… |
CVE-2017-12869 | High | 7.5 | 2017-09-01 | The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication sourc… |
CVE-2017-12868 | Critical | 9.8 | 2017-09-01 | The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct se… |
CVE-2017-12867 | Medium | 5.9 | 2017-08-29 | The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and earlier allows attackers with access to a secret token to extend its validity period by… |
CVE-2016-9955 | Medium | 6.3 | 2017-02-17 | The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before 1.14.11 might allow remote attackers to spoof signatures on SAML 1 responses or possibly… |
CVE-2016-9814 | Critical | 9.1 | 2017-02-17 | The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2… |
CVE-2016-3124 | Medium | 5.3 | 2017-02-07 | The sanitycheck module in SimpleSAMLphp before 1.14.1 allows remote attackers to learn the PHP version on the system via unspecified vectors. |
CVE-2012-0908 | | 2012-01-24 | Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitr… | |
CVE-2012-0040 | | 2012-01-24 | Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attack… |