CVE-2026-49283

Name of the Vulnerable Software and Affected Versions SimpleSAMLphp versions prior to 4.19.3 SimpleSAMLphp versions prior to 4.20.2 SimpleSAMLphp versions prior to 5.0.6 SimpleSAMLphp versions prior to 6.2.1

Description In the HTTPArtifact::receive() flow, the library may treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider (IdP). This occurs because SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response uses a validator that delegates to the outer message. Subsequently, the Response is checked against metadata from the embedded response issuer instead of the artifact issuer. Because SOAPClient::validateSSL() returns normally even when the TLS public key does not match the key being validated, and SAML2Message::validate() treats any non-throwing validator call as successful, a malicious or lower-trust IdP in a multi-IdP federation can provide an ArtifactResponse containing an unsigned Response. This allows the attacker to impersonate a higher-trust victim IdP and authenticate as arbitrary users with attacker-chosen NameID, session data, and assertion attributes.

Recommendations Update SimpleSAMLphp to version 4.19.3. Update SimpleSAMLphp to version 4.20.2. Update SimpleSAMLphp to version 5.0.6. Update SimpleSAMLphp to version 6.2.1.