CVE-2024-47832

Name of the Vulnerable Software and Affected Versions SSOReady versions prior to 7f92a06

Description The issue concerns XML signature bypass attacks. An attacker can exploit differential behavior between XML parsers to carry out signature bypass if they have access to certain IDP-signed messages. Users of the public hosted instance of SSOReady are unaffected. The vulnerability was discovered by a security researcher and its precise mechanism is not publicly disclosed to prevent potential attacks on other SAML implementations.

Recommendations To resolve the issue, upgrade to SSOReady version 7f92a06 or later by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.