CVE-2017-12869
SimpleSAMLphp Authentication context bypass in the multiauth module
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
CVE-2017-12869- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
CVE-2017-12869- Updated
- 2026-11-02
EUVDEUVD-2022-4943 No score
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
EUVD-2022-4943- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc43-78vj-vg7p
SimpleSAMLphp Authentication context bypass in the multiauth module
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
GHSA-qc43-78vj-vg7p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
CVE-2017-12869- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-12869
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
DEBIAN-CVE-2017-12869- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-qc43-78vj-vg7p
SimpleSAMLphp Authentication context bypass in the multiauth module
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
GHSA-qc43-78vj-vg7p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-12869
The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.
- Record
UBUNTU-CVE-2017-12869- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
simplesamlphp/simplesamlphpPackagist |
before 1.14.14 | 1.14.14 |
simplesamlphpDebian:12 |
before 1.14.15-1 | 1.14.15-1 |
simplesamlphpDebian:14 |
before 1.14.15-1, plus listed versions 1.10.0-11.11.0-11.12.0-11.12.0~rc1-11.12.0~rc2-1 Show 33 moreShow less1.13.0-11.13.1-11.13.1-21.13.2-11.14.0-11.14.1-11.14.10-11.14.11-11.14.2-11.14.2-21.14.3-11.14.4-11.14.5-11.14.6-11.14.7-11.14.8-11.14.9-11.6.0-11.6.1-11.6.2-11.6.3-11.6.3-21.6.3-31.7.0-11.7.0-21.8.0-11.8.1-11.8.2-11.9.0-11.9.0~rc1-11.9.0~rc2-11.9.1-11.9.2-1 |
1.14.15-1 |
simplesamlphpDebian:7 From an advisory covering 6 CVEs |
before 1.9.2-1+deb7u1, plus listed versions 1.9.2-1 |
1.9.2-1+deb7u1 |
simplesamlphpDebian:8 From an advisory covering 9 CVEs |
before 1.13.1-2+deb8u1, plus listed versions 1.13.1-2 |
1.13.1-2+deb8u1 |
simplesamlphpDebian:9 From an advisory covering 9 CVEs |
before 1.14.11-1+deb9u1, plus listed versions 1.14.11-1 |
1.14.11-1+deb9u1 |
simplesamlphp/simplesamlphpPackagist |
before 1.14.14, plus listed versions v1.12.0v1.13.0v1.13.0-rc1v1.13.0-rc2v1.13.1 Show 16 moreShow lessv1.13.2v1.14.0v1.14.0-rc1v1.14.1v1.14.10v1.14.11v1.14.12v1.14.13v1.14.2v1.14.3v1.14.4v1.14.5v1.14.6v1.14.7v1.14.8v1.14.9 |
1.14.14 |
simplesamlphpUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.13.2-11.14.0-11.14.0-1ubuntu21.14.0-1ubuntu2+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12869 is a high vulnerability (CVSS 7.5) in Simplesamlphp, published September 1, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.37%, the 83rd percentile. Fixed in simplesamlphp/simplesamlphp 1.14.14.
References
simplesamlphp.org/security/201704-02
lists.debian.org/debian-lts-announce/2017/12/msg00007.html
debian.org/security/2018/dsa-4127
nvd.nist.gov/vuln/detail/CVE-2017-12869
github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2017-12869.yaml