Vulnerability Description
SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Simplesamlphp | Simplesamlphp | < 2.4.7 |
Related Weaknesses (CWE)
References
- https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.4.7ProductRelease Notes
- https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.5.2ProductRelease Notes
- https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-q8r6-xj3Vendor Advisory
FAQ
What is CVE-2026-49284?
CVE-2026-49284 is a vulnerability with a CVSS score of 7.1 (HIGH). SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated l...
How severe is CVE-2026-49284?
CVE-2026-49284 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-49284?
Check the references section above for vendor advisories and patch information. Affected products include: Simplesamlphp Simplesamlphp.