CVE-2026-49289 simplesamlphp CVE debrief

Who should care

Entities using SimpleSAMLphp or the SAML2 library, particularly those responsible for SAML2-related functionality and security, should assess their exposure and prioritize verification of their configurations.

Why it matters

CVE-2026-49289 is a vulnerability in the SimpleSAMLphp SAML2 library that could allow a remote unauthenticated attacker to deny service. Entities using SimpleSAMLphp or the SAML2 library should assess exposure and prioritize verification of their configurations.

• Potential denial of service to entities relying on SimpleSAMLphp or the SAML2 library
• Need for verification of SimpleSAMLphp or SAML2 library versions and configurations
• Possible impact on SAML2-related functionality and security

Technical summary

The SimpleSAMLphp SAML2 library, in versions 4.19.2 and 4.20.2, permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. This could allow a remote unauthenticated attacker to consume uncontrolled processing resources, effectively denying service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

Defensive priority

Entities using SimpleSAMLphp or the SAML2 library should assess exposure and prioritize verification of their configurations.

Recommended defensive actions

• Assess exposure by verifying if the used SimpleSAMLphp or SAML2 library versions are 4.19.2, 4.20.2, or earlier
• Check if the entity relies on SimpleSAMLphp or directly on the SAML2 library
• Consider upgrading to versions 4.19.3 or 4.20.3 of the SimpleSAMLphp SAML2 library
• Review and limit the number of XPath transforms permitted in XML signatures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and affected versions. The SimpleSAMLphp SAML2 library, in versions 4.19.2 and 4.20.2, permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. This could allow a remote unauthenticated attacker to consume uncontrolled processing resources, effectively denying service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. Evidence is limited to public CVE and NVD sources

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.