Skip to content
Simplesamlphp vulnerabilities
Newest
-
simplesamlphp
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
CVE-2026-49284
Fix available
7.1 High
-
simplesamlphp saml2
SimpleSAMLphp SAML2: Possible DoS via XPath Transform
CVE-2026-49289
Fix available
7.5 High
-
simplesamlphp saml2
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
CVE-2026-49283
Fix available
8.7 High
-
simplesamlphp simplesamlphp-module-casserver
SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion
CVE-2026-46491
Fix available
8.6 High
-
simplesamlphp simplesamlphp-module-casserver
SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout
CVE-2025-65954
Fix available
4.7 Medium
-
simplesamlphp xml-security
xml-security is Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
CVE-2026-32600
Fix available
8.2 High
-
simplesamlphp saml2
SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding
CVE-2025-27773
Fix available
8.6 High
-
simplesamlphp saml2
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
CVE-2024-52806
Public exploitFix available
8.3 High
-
simplesamlphp xml-common
SimpleSAMLphp xml-common XXE vulnerability
CVE-2024-52596
Fix available
8.8 High
-
simplesamlphp xml-security
Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing ...
CVE-2024-34580
Disputed
5.3 Medium
-
simplesamlphp xml-security, saml2 +1 more
Validation of SignedInfo
CVE-2023-49087
Fix available
6.8 Medium
-
simplesamlphp saml2
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
CVE-2023-41890
Fix available
7.5 High
-
simplesamlphp simplesamlphp-module-openidprovider
simplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scripting
CVE-2010-10008
Fix available
3.5 Low
-
simplesamlphp information cards module
Information Cards Module cross site scripting
CVE-2010-10004
Fix available
3.5 Low
-
simplesamlphp simplesamlphp-module-openid
SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting
CVE-2010-10002
Fix available
3.1 Low
-
simplesamlphp
Information disclosure of source code in SimpleSAMLphp
CVE-2020-5301
Fix available
3.0 Low
-
simplesamlphp saml2
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
CVE-2020-5268
Fix available
6.5 Medium
-
simplesamlphp saml2
Missing Token Replay Detection
CVE-2020-5261
Fix available
8.2 High
-
simplesamlphp
Cross-site scripting in SimpleSAMLphp
CVE-2020-5226
Fix available
4.4 Medium
-
simplesamlphp
Log injection in SimpleSAMLphp
CVE-2020-5225
Fix available
4.4 Medium
-
simplesamlphp, xmlseclibs project xmlseclibs, debian linux +2 more
Signature validation bypass in XmlSecLibs
CVE-2019-3465
Fix available
8.8 High
-
simplesamlphp saml2, simplesamlphp, debian linux +2 more
SimpleSAMLphp saml2 incorrect signature validation
CVE-2018-7711
Fix available
8.1 High
-
simplesamlphp
SimpleSAMLphp Improper Verification of Cryptographic Signature
CVE-2018-7644
Fix available
7.5 High
-
simplesamlphp, debian linux +1 more
SimpleSAMLphp Signature validation bypass
CVE-2017-18122
Fix available
8.1 High
-
simplesamlphp, debian linux +1 more
SimpleSAMLphp XSS Vulnerability
CVE-2017-18121
Fix available
6.1 Medium
-
simplesamlphp, debian linux +1 more
SimpleSAMLphp Use of insecure connection charset (sqlauth module)
CVE-2018-6521
Fix available
9.8 Critical
-
simplesamlphp
SimpleSAMLphp Open redirection protection bypass
CVE-2018-6520
Fix available
6.1 Medium
-
simplesamlphp saml2, debian linux +1 more
SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability
CVE-2018-6519
Fix available
7.5 High
-
simplesamlphp infocard module, debian linux +1 more
SimpleSAMLphp InfoCard module Incorrect signature verification
CVE-2017-12874
Fix available
7.5 High
-
simplesamlphp, debian linux +1 more
Incorrect persistent NameID generation in SimpleSAMLphp
CVE-2017-12873
Fix available
9.8 Critical
-
simplesamlphp, debian linux +1 more
SimpleSAMLphp allows timing side-channel attacks
CVE-2017-12872
Fix available
5.9 Medium
-
simplesamlphp
SimpleSAMLphp Incorrect IV generation for encryption
CVE-2017-12871
Fix available
5.9 Medium
-
simplesamlphp
SimpleSAMLphp Unauthenticated encryption in CBC mode
CVE-2017-12870
Fix available
5.9 Medium
-
simplesamlphp, debian linux +1 more
SimpleSAMLphp Authentication context bypass in the multiauth module
CVE-2017-12869
Fix available
7.5 High
-
simplesamlphp
SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
CVE-2017-12868
Fix available
9.8 Critical
-
simplesamlphp
SimpleSAMLphp Invalid token creation and validation
CVE-2017-12867
Fix available
5.9 Medium
-
simplesamlphp, debian linux +1 more
Incorrect signature verification in SimpleSAMLphp
CVE-2016-9955
Fix available
6.3 Medium
-
simplesamlphp saml2, simplesamlphp +1 more
SimpleSAMLphp SAML2 spoof SAML responses
CVE-2016-9814
Fix available
9.1 Critical
-
simplesamlphp
SimpleSAMLphp Information leakage issue in the sanitycheck module
CVE-2016-3124
Fix available
5.3 Medium
-
simplesamlphp
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other...
CVE-2012-0908
Fix available
4.3 Medium
-
simplesamlphp
Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1...
CVE-2012-0040
Fix available
4.3 Medium
-
simplesamlphp, debian linux +1 more
simpleSAMLphp incorrectly handles XML encryption
CVE-2011-4625
Fix available
7.5 High