CVE-2026-49283
Received Received - Intake

Authentication Bypass in SimpleSAMLphp SAML2 Library

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-49283
EUVD
EUVD-2026-62502

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
simplesamlphp saml2 4.19.3
simplesamlphp saml2 4.20.2
simplesamlphp saml2 5.0.6
simplesamlphp saml2 6.2.1
simplesamlphp saml2 to 6.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the SimpleSAMLphp SAML2 library before versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1. It involves a flaw in the HTTP-Artifact receive flow where an unsigned embedded SAML Response can be incorrectly treated as cryptographically valid for a different Identity Provider (IdP). The issue stems from improper SSL key validation in SOAP requests, allowing a malicious or lower-trust IdP to forge an unsigned SAML Response claiming to be from a higher-trust IdP. This enables authentication bypass and identity impersonation across IdPs in multi-IdP federations.

Detection Guidance

Check SimpleSAMLphp SAML2 library versions using commands like 'composer show simplesamlphp/saml2' or 'php -r "echo class_exists(\'SAML2\\Message\') ? \'Installed\' : \'Not installed\';"'. Monitor logs for failed SAML artifact validation attempts or mismatched SSL keys during SOAP requests.

Impact Analysis

If you use SimpleSAMLphp in a multi-IdP federation, an attacker could exploit this to impersonate users from a higher-trust IdP. This could allow unauthorized access to sensitive systems, data breaches, or privilege escalation. The attacker can forge SAML assertions with arbitrary attributes, user identities, and session data, bypassing authentication controls.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It undermines authentication mechanisms, potentially causing non-compliance with access control and integrity requirements in these regulations.

Mitigation Strategies

Upgrade SimpleSAMLphp SAML2 library to versions 4.19.3, 4.20.2, 5.0.6, or 6.2.1 or later. Review and update SAML federation configurations to ensure proper IdP validation. Monitor IdP communications for unexpected artifact responses or unsigned SAML assertions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49283. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart