{"id":"CVE-2025-27773","aliases":["DEBIAN-CVE-2025-27773","DLA-4161-1","EUVD-2025-7804","GHSA-46r4-f8gj-xg56","UBUNTU-CVE-2025-27773","USN-8770-1"],"status":"published","title":"SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00415,"percentile":0.36122,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2025-03-11T19:04:52Z","modified":"2026-11-04T10:45:50Z","fixes":[{"ecosystem":"Packagist","package":"simplesamlphp/saml2","fixed_in":["5.0.0-alpha.20","4.17.0"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"simplesamlphp/saml2-legacy","fixed_in":["4.17.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"simplesamlphp","fixed_in":["1.19.7-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"simplesamlphp","fixed_in":["1.19.7-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"simplesamlphp","fixed_in":["1.19.0-1+deb11u2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","fixed_in":["1.14.0-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","fixed_in":["1.15.3-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"simplesamlphp","fixed_in":["1.18.4-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"simplesamlphp","fixed_in":["1.19.1-1.1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"simplesamlphp","fixed_in":["1.19.7-1+deb12u1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"simplesamlphp/saml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-alpha.1"},{"last_affected":"5.0.0-alpha.19"},{"fixed":"5.0.0-alpha.20"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"simplesamlphp/saml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.16.15"},{"fixed":"4.17.0"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"simplesamlphp/saml2-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.16.15"},{"fixed":"4.17.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-1+deb12u2"}]}],"versions":["1.19.7-1","1.19.7-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-2"}]}],"versions":["1.10.0-1","1.11.0-1","1.12.0-1","1.12.0~rc1-1","1.12.0~rc2-1","1.13.0-1","1.13.1-1","1.13.1-2","1.13.2-1","1.14.0-1","1.14.1-1","1.14.10-1","1.14.11-1","1.14.15-1","1.14.2-1","1.14.2-2","1.14.3-1","1.14.4-1","1.14.5-1","1.14.6-1","1.14.7-1","1.14.8-1","1.14.9-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1","1.15.4-1","1.16.0-1","1.16.1-1","1.16.2-1","1.16.3-1","1.17.0-1","1.17.1-1","1.17.2-1","1.17.2-2","1.17.3-1","1.17.4-1","1.17.5-1","1.17.6-1","1.17.6-2","1.18.1-1","1.18.4-1","1.18.5-1","1.18.6-1","1.18.7-1","1.18.8-1","1.19.0-1","1.19.1-1","1.19.1-1.1","1.19.6-1","1.19.7-1","1.6.0-1","1.6.1-1","1.6.2-1","1.6.3-1","1.6.3-2","1.6.3-3","1.7.0-1","1.7.0-2","1.8.0-1","1.8.1-1","1.8.2-1","1.9.0-1","1.9.0~rc1-1","1.9.0~rc2-1","1.9.1-1","1.9.2-1"]},{"source":"osv","ecosystem":"Debian:11","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.0-1+deb11u2"}]}],"versions":["1.19.0-1","1.19.0-1+deb11u1"]},{"source":"osv","ecosystem":"Packagist","package":"simplesamlphp/saml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0"}]}],"versions":["4.6.9","v0.1.0","v0.1.0-alpha","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.5.0","v0.6.0","v0.6.1","v0.6.2","v0.6.3","v0.6.4","v0.7.0","v0.7.1","v0.8.0","v0.8.1","v1.0.0","v1.1.0","v1.10","v1.10.1","v1.10.2","v1.10.3","v1.10.4","v1.10.5","v1.10.6","v1.2.0","v1.3.0","v1.3.1","v1.3.2","v1.4.0","v1.5.0","v1.5.1","v1.5.2","v1.5.3","v1.5.4","v1.6.0","v1.6.1","v1.7.0","v1.7.1","v1.7.2","v1.8","v1.8.1","v1.8.2","v1.9","v1.9.1","v1.9.2","v2.0.0","v2.0.1","v2.1","v2.2","v2.3","v2.3.1","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.2","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.3.0","v3.3.1","v3.3.10","v3.3.11","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v3.4.4","v3.4.5","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.16.14","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.3.0","v4.3.1","v4.4.0","v4.4.1","v4.5.0","v4.5.1","v4.6.0","v4.6.1","v4.6.10","v4.6.11","v4.6.12","v4.6.13","v4.6.14","v4.6.15","v4.6.16","v4.6.2","v4.6.3","v4.6.4","v4.6.5","v4.6.6","v4.6.7","v4.6.8"]},{"source":"osv","ecosystem":"Packagist","package":"simplesamlphp/saml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0-alpha.1"},{"fixed":"5.0.0-alpha.20"}]}]},{"source":"osv","ecosystem":"Packagist","package":"simplesamlphp/saml2-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.0"}]}],"versions":["4.6.9","v0.1.0","v0.1.0-alpha","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.5.0","v0.6.0","v0.6.1","v0.6.2","v0.6.3","v0.6.4","v0.7.0","v0.7.1","v0.8.0","v0.8.1","v1.0.0","v1.1.0","v1.10","v1.10.1","v1.10.2","v1.10.3","v1.10.4","v1.10.5","v1.10.6","v1.2.0","v1.3.0","v1.3.1","v1.3.2","v1.4.0","v1.5.0","v1.5.1","v1.5.2","v1.5.3","v1.5.4","v1.6.0","v1.6.1","v1.7.0","v1.7.1","v1.7.2","v1.8","v1.8.1","v1.8.2","v1.9","v1.9.1","v1.9.2","v2.0.0","v2.0.1","v2.1","v2.2","v2.3","v2.3.1","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9","v3.0.0","v3.0.1","v3.0.2","v3.0.3","v3.1.0","v3.1.1","v3.1.2","v3.1.3","v3.1.4","v3.1.5","v3.1.6","v3.2","v3.2.1","v3.2.2","v3.2.3","v3.2.4","v3.2.5","v3.2.6","v3.3.0","v3.3.1","v3.3.10","v3.3.11","v3.3.2","v3.3.3","v3.3.4","v3.3.5","v3.3.6","v3.3.7","v3.3.8","v3.3.9","v3.4.0","v3.4.1","v3.4.2","v3.4.3","v4.0.0","v4.0.1","v4.0.2","v4.0.3","v4.1.0","v4.1.1","v4.1.10","v4.1.11","v4.1.12","v4.1.2","v4.1.3","v4.1.4","v4.1.5","v4.1.6","v4.1.7","v4.1.8","v4.1.9","v4.16.14","v4.2.0","v4.2.1","v4.2.2","v4.2.3","v4.2.4","v4.2.5","v4.2.6","v4.2.7","v4.2.8","v4.3.0","v4.3.1","v4.4.0","v4.4.1","v4.5.0","v4.5.1","v4.6.0","v4.6.1","v4.6.10","v4.6.11","v4.6.12","v4.6.13","v4.6.14","v4.6.15","v4.6.16","v4.6.2","v4.6.3","v4.6.4","v4.6.5","v4.6.6","v4.6.7","v4.6.8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2+esm1"}]}],"versions":["1.13.2-1","1.14.0-1","1.14.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-1ubuntu0.1~esm1"}]}],"versions":["1.14.15-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1ubuntu0.1~esm1"}]}],"versions":["1.17.5-1","1.17.6-1","1.17.6-2","1.18.1-1","1.18.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-1.1ubuntu0.1~esm1"}]}],"versions":["1.19.1-1","1.19.1-1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-1+deb12u1ubuntu0.1"}]}],"versions":["1.19.7-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.7-1+deb12u1","1.19.7-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-1ubuntu2+esm1"}]}],"versions":["1.13.2-1","1.14.0-1","1.14.0-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-1ubuntu0.1~esm1"}]}],"versions":["1.14.15-1","1.15.0-1","1.15.1-1","1.15.2-1","1.15.3-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.4-1ubuntu0.1~esm1"}]}],"versions":["1.17.5-1","1.17.6-1","1.17.6-2","1.18.1-1","1.18.4-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.1-1.1ubuntu0.1~esm1"}]}],"versions":["1.19.1-1","1.19.1-1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"simplesamlphp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.7-1+deb12u1ubuntu0.1"}]}],"versions":["1.19.7-1"],"bundled":3}],"products":[{"vendor":"simplesamlphp","product":"saml2"}],"references":[{"url":"https://github.com/simplesamlphp/saml2/security/advisories/GHSA-46r4-f8gj-xg56","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/simplesamlphp/saml2/commit/7867d6099dc7f31bed1ea10e5bea159c5623d2a0","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217","tags":["x_refsource_MISC","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27773","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-46r4-f8gj-xg56"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27773.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-27773","tags":["advisory"]},{"url":"https://github.com/simplesamlphp/saml2","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-27773","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-27773","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8770-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-52596","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-27773","title":"SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:04:52.135Z","modified":"2025-05-09T20:03:38.107Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:32:42.078906Z"}],"euvd":[{"id":"EUVD-2025-7804","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:04:52Z","modified":"2025-05-09T20:03:38Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:32:50.201515Z"}],"ghsa":[{"id":"GHSA-46r4-f8gj-xg56","title":"The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding","description":"### Summary\nThere's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.\n\nI believe that it exists for v4 only. I have not yet developed a PoC.\n\nV5 is well designed and instead builds the signed query from the same message that will be consumed.\n### Details\n\n#### What is verified\nThe data['SignedQuery'] is the string that will be verified by the public key. \n\nIt is defined here:\nhttps://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217\n\nTHe code will iterate through each parameter name. Notably, sigQuery is overridden each time when processing, making the last of SAMLRequest/SAMLResponse used for sigQuery.\n\nFor example, given:\n\nSAMLRequest=a\u0026SAMLResponse=idpsigned\n\nSAMLResponse=idpsigned will be set as sigQuery, then later verified\n\n\n#### What is actually processed\n\nProcessing uses SAMLRequest parameter value first, (if it exists) then SAMLResponse:\n\nhttps://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113\n\nGiven this, the contents that are processed might not be the same as the data that is actually verified.\n\n\n### Exploiting\nSuppose an attacker has a signed HTTP Redirect binding from IdP, say a signed logout response. :\n\nSAMLResponse=idpsigned\u0026RelayState=...\u0026SigAlg=...\u0026Signature\n\n\nThen an attacker can append SAMLRequest in front:\n\n`SAMLRequest=unverifieddata\u0026SAMLResponse=idpsigned\u0026RelayState=...\u0026SigAlg=...\u0026Signature=..`\n\nSimpleSAMLPhp will only verify the SAMLResponse, but will actually use the SAMLRequest contents. The impact here is increased because there's no checks that SAMLRequest actually contains a Request, it could instead contain an Response, which allows the attacker to effectively impersonate any user within the SP.\n\n\n### IdPs\n\nMicrosoft Azure AD/Entra (and likely ADFS) signs the LogoutResponse via this SimpleSign format in HTTP Redirect binding. If an attacker logs out of Entra, they will be able to extract a valid Signature.\n\nAttached is an HTTP Request when an I initiated a SLO request from the service provider to the IdP (entra). Then IdP POSTed this SAMLResponse with HTTP Redirect binding signature, via the user browser to the SP. It should be possible to carry out the described attack with this.\n\n```\nhttps://webhook.site/c6038292-6ef5-46ac-973d-d7c25520ec48/logout?SAMLResponse=fVJNa%2bMwEP0rRndZtmw5tnAMy%2fYSaC9N6aGXIsmjVMTRGI9M%2bvObdeihsPQ4w7x5HzM9mcs060c84ZqegWaMBNnhYc%2fejS1UW1TAnVU7XldK8s7JkcvOd60Db3zTsewVFgoY90zmBcsORCscIiUT061VyJqXJS%2fbl7LRUmrZ5mXdvLHsASiFaNKG%2fEhpJi3EFewH4jmnkEC4pqha2UnegFe8bozj3a4a%2bbhzUilZgKtbMW2yb7TxW%2foL7lkM9hTC2XnEOPvZXjDECb2N1lh7mvBsp%2bnsErDs8zJF0lsEe7YuUaOhQDqaC5BOTh%2f%2fPD3qmzE9L5jQ4cSGfrO43KG%2fgwwRLP8ssuHbIiXKryGOeKU8QhLSVN7WteejV8Bru%2bt4WynFbwE3bdVV5ahG0Ys759Dfj3VMJq30s%2fqLI2SvZlrhd020Tevj6hwQMTH04udS8b%2bHGL4A\u0026Signature=Z%2f7gIPv7Gkgvqtwo0bzgXyum9IjHMfP0zTYuNbl%2fBUGlQ%2fU%2bbOZGZJ6Rk9wLUyvNQ5XlZRxZrfESNA%2bn0CVyIedsg9GxQKTi7VqPTJFJqEIP1BZaEpYYP3%2f6sFfLxfTMKecJoQdxnDE5Malte1hMj2UujWnLXOnp0CgO%2f%2fU2K52SoGckIzNDRB%2fJ6%2fysTn%2bDjBrmgdro%2fgdTyby9%2f3vm8dzY8pUkRCgMjlimShrZxr5U33wQvwPLIXlDgActr91RUtWKE0k8sy%2brshrK9DKLPo8AdTLk7NYhjSWdF7OG7uqgEeEo470tacqQuA09E0qDh8CWS%2bycLJijiGYWVyQa4Q%3d%3d\u0026SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256\n```","status":"published","published":"2025-03-11T19:23:22Z","modified":"2025-05-09T21:31:52Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2025-27773","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:15:43.677Z","modified":"2026-06-17T09:04:11.953Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"CVE-2025-27773","title":"SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:04:52.135Z","modified":"2026-11-04T10:45:50.072688499Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-04T11:07:13.540858Z"},{"id":"DEBIAN-CVE-2025-27773","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:15:43.677Z","modified":"2026-09-01T20:05:45.315983416Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"GHSA-46r4-f8gj-xg56","title":"The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding","description":"### Summary\nThere's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.\n\nI believe that it exists for v4 only. I have not yet developed a PoC.\n\nV5 is well designed and instead builds the signed query from the same message that will be consumed.\n### Details\n\n#### What is verified\nThe data['SignedQuery'] is the string that will be verified by the public key. \n\nIt is defined here:\nhttps://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217\n\nTHe code will iterate through each parameter name. Notably, sigQuery is overridden each time when processing, making the last of SAMLRequest/SAMLResponse used for sigQuery.\n\nFor example, given:\n\nSAMLRequest=a\u0026SAMLResponse=idpsigned\n\nSAMLResponse=idpsigned will be set as sigQuery, then later verified\n\n\n#### What is actually processed\n\nProcessing uses SAMLRequest parameter value first, (if it exists) then SAMLResponse:\n\nhttps://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113\n\nGiven this, the contents that are processed might not be the same as the data that is actually verified.\n\n\n### Exploiting\nSuppose an attacker has a signed HTTP Redirect binding from IdP, say a signed logout response. :\n\nSAMLResponse=idpsigned\u0026RelayState=...\u0026SigAlg=...\u0026Signature\n\n\nThen an attacker can append SAMLRequest in front:\n\n`SAMLRequest=unverifieddata\u0026SAMLResponse=idpsigned\u0026RelayState=...\u0026SigAlg=...\u0026Signature=..`\n\nSimpleSAMLPhp will only verify the SAMLResponse, but will actually use the SAMLRequest contents. The impact here is increased because there's no checks that SAMLRequest actually contains a Request, it could instead contain an Response, which allows the attacker to effectively impersonate any user within the SP.\n\n\n### IdPs\n\nMicrosoft Azure AD/Entra (and likely ADFS) signs the LogoutResponse via this SimpleSign format in HTTP Redirect binding. If an attacker logs out of Entra, they will be able to extract a valid Signature.\n\nAttached is an HTTP Request when an I initiated a SLO request from the service provider to the IdP (entra). Then IdP POSTed this SAMLResponse with HTTP Redirect binding signature, via the user browser to the SP. It should be possible to carry out the described attack with this.\n\n```\nhttps://webhook.site/c6038292-6ef5-46ac-973d-d7c25520ec48/logout?SAMLResponse=fVJNa%2bMwEP0rRndZtmw5tnAMy%2fYSaC9N6aGXIsmjVMTRGI9M%2bvObdeihsPQ4w7x5HzM9mcs060c84ZqegWaMBNnhYc%2fejS1UW1TAnVU7XldK8s7JkcvOd60Db3zTsewVFgoY90zmBcsORCscIiUT061VyJqXJS%2fbl7LRUmrZ5mXdvLHsASiFaNKG%2fEhpJi3EFewH4jmnkEC4pqha2UnegFe8bozj3a4a%2bbhzUilZgKtbMW2yb7TxW%2foL7lkM9hTC2XnEOPvZXjDECb2N1lh7mvBsp%2bnsErDs8zJF0lsEe7YuUaOhQDqaC5BOTh%2f%2fPD3qmzE9L5jQ4cSGfrO43KG%2fgwwRLP8ssuHbIiXKryGOeKU8QhLSVN7WteejV8Bru%2bt4WynFbwE3bdVV5ahG0Ys759Dfj3VMJq30s%2fqLI2SvZlrhd020Tevj6hwQMTH04udS8b%2bHGL4A\u0026Signature=Z%2f7gIPv7Gkgvqtwo0bzgXyum9IjHMfP0zTYuNbl%2fBUGlQ%2fU%2bbOZGZJ6Rk9wLUyvNQ5XlZRxZrfESNA%2bn0CVyIedsg9GxQKTi7VqPTJFJqEIP1BZaEpYYP3%2f6sFfLxfTMKecJoQdxnDE5Malte1hMj2UujWnLXOnp0CgO%2f%2fU2K52SoGckIzNDRB%2fJ6%2fysTn%2bDjBrmgdro%2fgdTyby9%2f3vm8dzY8pUkRCgMjlimShrZxr5U33wQvwPLIXlDgActr91RUtWKE0k8sy%2brshrK9DKLPo8AdTLk7NYhjSWdF7OG7uqgEeEo470tacqQuA09E0qDh8CWS%2bycLJijiGYWVyQa4Q%3d%3d\u0026SigAlg=http%3a%2f%2fwww.w3.org%2f2001%2f04%2fxmldsig-more%23rsa-sha256\n```","status":"published","published":"2025-03-11T19:23:22Z","modified":"2026-09-10T03:50:56.811522448Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"UBUNTU-CVE-2025-27773","description":"The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.","status":"published","published":"2025-03-11T19:15:00Z","modified":"2026-09-15T20:16:38.366034048Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"DLA-4161-1","title":"simplesamlphp - security update","status":"published","published":"2025-05-09T00:00:00Z","modified":"2026-03-09T01:23:09.363613Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-8770-1","title":"simplesamlphp vulnerabilities","description":"It was discovered that SimpleSAMLphp incorrectly validated cryptographic\nsignatures in XML messages. An authenticated attacker could possibly use\nthis issue to impersonate users or gain elevated privileges. This issue\nonly affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-3465)\n\nIt was discovered that SimpleSAMLphp incorrectly handled external entities\nwhen parsing untrusted XML documents. A remote attacker could possibly use\nthis issue to obtain sensitive information. This issue did not affect\nUbuntu 24.04 LTS. (CVE-2024-52596)\n\nIt was discovered that SimpleSAMLphp incorrectly verified signatures in\nSAML messages using the HTTP-Redirect binding. A remote attacker could\npossibly use this issue to bypass authentication and impersonate users.\n(CVE-2025-27773)","status":"published","published":"2026-09-15T16:16:00Z","modified":"2026-09-16T02:57:27.4192406Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}