CVE-2026-49289: falha de alta gravidade em simplesamlphp saml2
SimpleSAMLphp SAML2: Possible DoS via XPath Transform
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
simplesamlphp · saml2CVEs relacionadas — simplesamlphp saml2
No mesmo produto, das mais perigosas para as menos.
CVE-2026-49283HIGHSimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypassEPSS 0.5%CVE-2024-52806HIGHSimpleSAMLphp SAML2 has an XXE in parsing SAML messagesEPSS 0.4%CVE-2025-27773HIGHSimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect bindingEPSS 0.4%