CVE-2017-12868
SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
CVE-2017-12868- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-384
- Updated
- 2026-11-02
CVE List No score
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
CVE-2017-12868- Updated
- 2026-11-02
EUVDEUVD-2022-4319 No score
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
EUVD-2022-4319- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j96g-47x2-46hv
SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
GHSA-j96g-47x2-46hv- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
CVE-2017-12868- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12868
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
DEBIAN-CVE-2017-12868- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-j96g-47x2-46hv
SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
GHSA-j96g-47x2-46hv- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12868
The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows attackers to conduct session fixation attacks or possibly bypass authentication by leveraging missing character conversions before an XOR operation.
- Record
UBUNTU-CVE-2017-12868- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simplesamlphp/simplesamlphpPackagist |
1.14.12 up to 1.14.14 | 1.14.14 |
simplesamlphpDebian:12 |
before 1.14.15-1 | 1.14.15-1 |
simplesamlphpDebian:14 |
before 1.14.15-1, plus listed versions 1.10.0-11.11.0-11.12.0-11.12.0~rc1-11.12.0~rc2-1 Show 33 moreShow less1.13.0-11.13.1-11.13.1-21.13.2-11.14.0-11.14.1-11.14.10-11.14.11-11.14.2-11.14.2-21.14.3-11.14.4-11.14.5-11.14.6-11.14.7-11.14.8-11.14.9-11.6.0-11.6.1-11.6.2-11.6.3-11.6.3-21.6.3-31.7.0-11.7.0-21.8.0-11.8.1-11.8.2-11.9.0-11.9.0~rc1-11.9.0~rc2-11.9.1-11.9.2-1 |
1.14.15-1 |
simplesamlphpDebian:7 From an advisory covering 6 CVEs |
before 1.9.2-1+deb7u1, plus listed versions 1.9.2-1 |
1.9.2-1+deb7u1 |
simplesamlphpDebian:8 From an advisory covering 2 CVEs |
before 1.13.1-2+deb8u2, plus listed versions 1.13.1-21.13.1-2+deb8u1 |
1.13.1-2+deb8u2 |
simplesamlphp/simplesamlphpPackagist |
1.14.12 up to 1.14.14, plus listed versions v1.14.12v1.14.13 |
1.14.14 |
simplesamlphpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.2-11.14.0-11.14.0-1ubuntu21.14.0-1ubuntu2+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12868 is a critical vulnerability (CVSS 9.8) in Simplesamlphp, published September 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.13%, the 82nd percentile. Fixed in simplesamlphp/simplesamlphp 1.14.14.
References
simplesamlphp.org/security/201705-01
lists.debian.org/debian-lts-announce/2017/12/msg00007.html
github.com/simplesamlphp/simplesamlphp/commit/4bc629658e7b7d17c9ac3fe0da7dc5df71f1b85e
nvd.nist.gov/vuln/detail/CVE-2017-12868