CVE-2026-49289: high-severity vulnerability in simplesamlphp saml2
SimpleSAMLphp SAML2: Possible DoS via XPath Transform
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.8%
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
simplesamlphp · saml2Related CVEs — simplesamlphp saml2
In the same product, most dangerous first.
CVE-2026-49283HIGHSimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypassEPSS 0.5%CVE-2024-52806HIGHSimpleSAMLphp SAML2 has an XXE in parsing SAML messagesEPSS 0.4%CVE-2025-27773HIGHSimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect bindingEPSS 0.4%