Packagist/simplesamlphp/xml-security CVE-2026-32600: high 8.2, EPSS 0.17%
simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption
Action: Upgrade simplesamlphp/xml-security to 1.13.9 or later.
composer require simplesamlphp/xml-security:2.3.1composer require simplesamlphp/xml-security:1.13.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.0 | 2.3.1 | - |
| 0 | 1.13.9 | - |
Fixed versions
| 2.3.1 | 1.13.9 |
Sources
- osv: GHSA-r353-4845-pr5p
- https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p
- https://nvd.nist.gov/vuln/detail/CVE-2026-32600
- https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520
- https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25
- https://github.com/simplesamlphp/xml-security
CVE-2026-32600 · published · modified · JSON