Every CVE Search/ Get API key

CVE-2025-9943

Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider

9.1 CriticalFix available

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.41%Up 0.4 points since Sep 10, 2025
90%50%10%1%

What each source reports

CVE List Score used 9.1

Unauthenticated SQL Injection Vulnerability in Shibboleth Service Provider

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Record
CVE-2025-9943
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2025-27518 9.1

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Record
EUVD-2025-27518
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-p7fp-v35q-pm7j 9.1

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response...

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Record
GHSA-p7fp-v35q-pm7j
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 9.1

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Record
CVE-2025-9943
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVDEBIAN-CVE-2025-9943 9.1

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.

Record
DEBIAN-CVE-2025-9943
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-9943 9.1

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271). This issue affects Shibboleth Service Provider through 3.5.0.

Record
UBUNTU-CVE-2025-9943
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 7 moreShow less
OSV No score

An SQL injection vulnerability has been identified in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service. An unauthenticated attacker can exploit this issue via blind SQL injection, allowing for the extraction of arbitrary data from the database, if the database connection is configured to use the ODBC plugin. The vulnerability arises from insufficient escaping of single quotes in the class SQLString (file odbc-store.cpp, lines 253-271).

This issue affects Shibboleth Service Provider through 3.5.0.

Record
CVE-2025-9943
Updated
2026-11-02
OSVopenSUSE-SU-2025:15714-1 No score

libshibsp-lite12-3.5.1-1.1 on GA media

These are all security issues fixed in the libshibsp-lite12-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15714-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21418-1 No score

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue

  • CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).
Record
openSUSE-SU-2026:21418-1
Updated
2026-11-02
OSVSUSE-SU-2026:22854-1 No score

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue

  • CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).
Record
SUSE-SU-2026:22854-1
Updated
2026-11-02
OSVSUSE-SU-2026:3098-1 No score

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue:

  • CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).
Record
SUSE-SU-2026:3098-1
Updated
2026-11-02
OSVSUSE-SU-2026:3123-1 No score

Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue:

  • CVE-2025-9943: SQL injection in the 'ID' attribute of the SAML response when the replay cache of the Shibboleth Service Provider (SP) is configured to use an SQL database as storage service (bsc#1249394).
Record
SUSE-SU-2026:3123-1
Updated
2026-11-02
OSVUSN-8768-1 No score

shibboleth-sp vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information.

Record
USN-8768-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
shibboleth-sp
Debian:12
 before 3.4.1+dfsg-2+deb12u1, plus listed versions
3.4.1+dfsg-2
3.4.1+dfsg-2+deb12u1
shibboleth-sp
Debian:13
 before 3.5.0+dfsg-2+deb13u1, plus listed versions
3.5.0+dfsg-2
3.5.0+dfsg-2+deb13u1
shibboleth-sp
Debian:14
 before 3.5.1+dfsg-1, plus listed versions
3.5.0+dfsg-2
3.5.1+dfsg-1
shibboleth-sp
Debian:11
 before 3.2.2+dfsg1-1+deb11u1, plus listed versions
3.2.2+dfsg1-1
3.2.2+dfsg1-1+deb11u1
shibboleth-sp
SUSE:Linux Enterprise Server 16.0
 before 3.5.0-160000.3.1
3.5.0-160000.3.1
shibboleth-sp
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 3.5.0-160000.3.1
3.5.0-160000.3.1
shibboleth-sp
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 2.5.5-6.9.1
2.5.5-6.9.1
shibboleth-sp
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 2.5.5-6.9.1
2.5.5-6.9.1
shibboleth-sp
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
shibboleth-sp
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 3.1.0-150300.3.6.1
3.1.0-150300.3.6.1
shibboleth-sp
Ubuntu:Pro:20.04:LTS
 before 3.0.4+dfsg1-1ubuntu0.2+esm1, plus listed versions
3.0.4+dfsg1-13.0.4+dfsg1-1build13.0.4+dfsg1-1ubuntu0.13.0.4+dfsg1-1ubuntu0.2
3.0.4+dfsg1-1ubuntu0.2+esm1
shibboleth-sp
Ubuntu:Pro:22.04:LTS
 before 3.3.0+dfsg1-1ubuntu0.1~esm1, plus listed versions
3.2.2+dfsg1-1ubuntu13.3.0+dfsg1-1
3.3.0+dfsg1-1ubuntu0.1~esm1
shibboleth-sp
Ubuntu:Pro:24.04:LTS
 before 3.4.1+dfsg-2.1ubuntu0.1~esm1, plus listed versions
3.4.1+dfsg-23.4.1+dfsg-2.13.4.1+dfsg-2.1build1
3.4.1+dfsg-2.1ubuntu0.1~esm1
shibboleth-sp
Ubuntu:25.10
 All versions, plus listed versions
3.5.0+dfsg-2
 None known
shibboleth-sp
openSUSE:Tumbleweed
 before 3.5.1-1.1
3.5.1-1.1
shibboleth-sp
openSUSE:Leap 16.0
 before 3.5.0-160000.3.1
3.5.0-160000.3.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-9943 is a critical vulnerability (CVSS 9.1) in Shibboleth Service Provider, published September 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in shibboleth-sp 3.4.1+dfsg-2+deb12u1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open