CVE-2017-12867

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions 1.14.14 and earlier

Description The issue allows attackers with access to a secret token to extend its validity period by manipulating the prepended time offset in the SimpleSAML Auth TimeLimitedToken class.

Recommendations For versions 1.14.14 and earlier, consider restricting access to the SimpleSAML Auth TimeLimitedToken class until a patch is available. As a temporary workaround, limit the ability to manipulate the time offset to prevent attackers from extending the token's validity period.