CVE-2026-49284
1 advisory.
Packagist/simplesamlphp/simplesamlphp CVE-2026-49284: high 7.1, EPSS 0.22%
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
Action: Upgrade simplesamlphp/simplesamlphp to 2.4.7 or later.
composer require simplesamlphp/simplesamlphp:2.5.2composer require simplesamlphp/simplesamlphp:2.4.7Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.5.0 | 2.5.2 | - |
| 0 | 2.4.7 | - |
Fixed versions
| 2.5.2 | 2.4.7 |
Sources
- osv: GHSA-q8r6-xj3f-wrrm
- https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-q8r6-xj3f-wrrm
- https://github.com/simplesamlphp/simplesamlphp
CVE-2026-49284 · published · modified · JSON