Simplesamlphp Saml2 vulnerabilities

• simplesamlphp saml2 SimpleSAMLphp SAML2: Possible DoS via XPath Transform CVE-2026-49289 Fix available 7.5 HighJuly 2, 2026
• simplesamlphp saml2 SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass CVE-2026-49283 Fix available 8.7 HighJuly 2, 2026
• simplesamlphp saml2 SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding CVE-2025-27773 Fix available 8.6 HighMarch 11, 2025
• simplesamlphp saml2 SimpleSAMLphp SAML2 has an XXE in parsing SAML messages CVE-2024-52806 Public exploitFix available 8.3 HighDecember 2, 2024
• simplesamlphp xml-security, saml2 +1 more Validation of SignedInfo CVE-2023-49087 Fix available 6.8 MediumNovember 28, 2023
• simplesamlphp saml2 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation CVE-2023-41890 Fix available 7.5 HighSeptember 19, 2023
• simplesamlphp saml2 Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET CVE-2020-5268 Fix available 6.5 MediumApril 21, 2020
• simplesamlphp saml2 Missing Token Replay Detection CVE-2020-5261 Fix available 8.2 HighMarch 25, 2020
• simplesamlphp saml2, simplesamlphp, debian linux +2 more SimpleSAMLphp saml2 incorrect signature validation CVE-2018-7711 Fix available 8.1 HighMarch 5, 2018
• simplesamlphp saml2, debian linux +1 more SimpleSAMLphp SAML2 library Regular Expression Denial of Service vulnerability CVE-2018-6519 Fix available 7.5 HighFebruary 2, 2018
• simplesamlphp saml2, simplesamlphp +1 more SimpleSAMLphp SAML2 spoof SAML responses CVE-2016-9814 Fix available 9.1 CriticalFebruary 16, 2017