CVE-2026-49284highCWE-345

CVE-2026-49284: fallo de gravedad alta en simplesamlphp

SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear simplesamlphp+ Monitorear simplesamlphp

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.2%
SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Productos afectados
simplesamlphp · simplesamlphp
CVEs relacionadas — simplesamlphp

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-5301LOWInformation disclosure of source code in SimpleSAMLphpEPSS 0.9%CVE-2011-4625—CVE-2011-4625EPSS 0.7%