CVE-2026-49283 simplesamlphp CVE debrief

Who should care

Defenders and administrators of multi-IdP federations using SimpleSAMLphp SAML2 library should assess exposure and prioritize updates to affected versions. They should review configurations for secure authentication, verify and update affected library versions, and assess exposure in multi-IdP federations.

Why it matters

CVE-2026-49283 allows for authentication as arbitrary users with attacker-chosen attributes in multi-IdP federations using SimpleSAMLphp SAML2 library, requiring defenders to verify and update affected versions.

• Arbitrary user authentication with attacker-chosen assertion attributes, NameID, and session data
• Potential for lateral movement and unauthorized access in multi-IdP federations
• Need for verification and updates to SimpleSAMLphp SAML2 library versions

Technical summary

The HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider due to improper validation in SOAPClient::addSSLValidator() and SAML2::Message::validate(). This issue allows for authentication as arbitrary users with attacker-chosen assertion attributes, NameID, and session data in a multi-IdP federation. The vulnerability is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1 of the SimpleSAMLphp SAML2 library. Defenders should prioritize verifying and updating affected library versions.

Defensive priority

Defenders should prioritize verifying and updating SimpleSAMLphp SAML2 library versions to 4.19.3, 4.20.2, 5.0.6, or 6.2.1, and assess exposure in multi-IdP federations.

Recommended defensive actions

• Verify and update SimpleSAMLphp SAML2 library versions to 4.19.3, 4.20.2, 5.0.6, or 6.2.1
• Assess exposure in multi-IdP federations
• Review and update configurations for secure authentication
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD vulnerability detail provide information on the issue, while source references from GitHub offer additional context and fixes. The issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1 of the SimpleSAMLphp SAML2 library. Defenders should verify and update affected versions, assess exposure in multi-IdP federations, and review configurations for secure authentication.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.