Catalyst It · Mahara · CVE-2012-2351
**Name of the Vulnerable Software and Affected Versions**
Mahara versions prior to 1.4.2
**Description**
The default configuration of the auth/saml plugin in Mahara allows remote SAML IdP servers to spoof users of other SAML IdP servers by using the same internal username, due to the "Match username attribute to Remote username" option being set to false.
**Recommendations**
For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider setting the "Match username attribute to Remote username" option to true to prevent user spoofing.