- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 4 high, 1 medium
- Registry
- Packagist
Advisories 9
- CVE-2026-49289High 7.5
SimpleSAMLphp SAML2: Possible DoS via XPath Transform
Affected: from 4.20.0, fixed in 4.20.3; fixed in 4.19.3.
- CVE-2026-49283High 8.7
SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
Affected: from 6.0.0, fixed in 6.2.1; from 5.0.0, fixed in 5.0.6; from 4.20.0, fixed in 4.20.2; fixed in 4.19.3.
- CVE-2025-27773High 8.6
SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding
Affected: fixed in 4.17.0; from 5.0.0-alpha.1, fixed in 5.0.0-alpha.20.
- CVE-2024-52806High 8.3
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
Affected: fixed in 4.6.14.
- CVE-2023-49087Medium 6.8
Validation of SignedInfo
Affected: from 5.0.0-alpha.12, fixed in 5.0.0-alpha.13.
- CVE-2018-7711Unrated
HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation…
Affected: fixed in 1.10.6; from 2.0, fixed in 2.3.8; from 3.0, fixed in 3.1.4.
- CVE-2018-7644Unrated
The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions…
Affected: fixed in 1.10.5; from 2.0, fixed in 2.3.7; from 3.0, fixed in 3.1.3.
- CVE-2018-6519Unrated
The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service…
Affected: fixed in 1.10.4; from 2.0, fixed in 2.3.5; from 3.0, fixed in 3.1.1.
- CVE-2016-9814Unrated
The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x…
Affected: from 1.10, fixed in 1.10.3; fixed in 1.8.1; from 1.9.0, fixed in 1.9.1; from 2.0, fixed in 2.3.3.