{"action":"Upgrade simplesamlphp/xml-security to 1.13.9 or later.","affected":[{"fixed":"2.3.1","introduced":"2.0.0"},{"fixed":"1.13.9","introduced":"0"}],"component":"simplesamlphp/xml-security","cve_ids":["CVE-2026-32600"],"ecosystem":"Packagist","epss":0.00151,"exploited":false,"fixed_versions":["2.3.1","1.13.9"],"ghsa_id":"GHSA-r353-4845-pr5p","id":"tcs_01M5KF7SPCWQC7H4PQWA3536QD","modified_at":"2026-03-16T22:16:26.818459Z","published_at":"2026-03-13T20:44:21Z","references":["https://osv.dev/vulnerability/GHSA-r353-4845-pr5p","https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p","https://nvd.nist.gov/vuln/detail/CVE-2026-32600","https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520","https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25","https://github.com/simplesamlphp/xml-security"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-r353-4845-pr5p","url":"https://osv.dev/vulnerability/GHSA-r353-4845-pr5p"}],"summary":"simplesamlphp/xml-security: Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption"}