CVE-2026-49289 in SimpleSAMLphp
Summary
by MITRE • 08/19/2026
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/21/2026
The SimpleSAMLphp library serves as a critical component for implementing Security Assertion Markup Language version two functionality within PHP-based web applications, facilitating single sign-on processes across diverse identity providers and service providers. Within this ecosystem, the SAML2 sub-library handles the complex parsing and validation of XML structures that constitute security assertions. A significant vulnerability was identified in versions 4.19.2 and 4.20.2 regarding how these libraries process XML signatures embedded within incoming SAML messages. The core technical flaw lies in the library's handling of XPath transforms during signature verification. Specifically, the implementation allowed attacker-controlled XPath expressions to be executed as part of the transform chain without sufficient restrictions on complexity or resource consumption. This design oversight creates a pathway for remote unauthenticated attackers to exploit the system by crafting malicious SAML messages that contain specially constructed XML signatures with deeply nested or computationally expensive XPath transforms.
When an entity relying on SimpleSAMLphp processes such a crafted message, the underlying XPath evaluation engine is forced to execute the attacker-defined logic. Because XPath expressions can be designed to trigger exponential time complexity during node set operations, this leads to uncontrolled consumption of server processing resources. The operational impact of this flaw is primarily centered around denial of service conditions. A remote attacker does not need valid credentials or prior authentication to exploit this vulnerability; they merely need to send the malicious payload to a vulnerable endpoint that validates SAML assertions. As multiple requests are processed, the server's CPU and memory usage can spike dramatically, potentially causing the application to become unresponsive or crash entirely. This affects any entity relying on SimpleSAMLphp for identity federation, including both service providers validating incoming assertions and identity providers processing logout requests or other signed metadata exchanges.
From a classification perspective, this vulnerability aligns with CWE-787 Improper Access Control in contexts where resource limits are not enforced, but more accurately maps to CWE-400 Uncontrolled Resource Consumption due to the specific nature of the denial-of-service impact through algorithmic complexity attacks. In terms of adversary tactics and techniques, this exploit corresponds to ATT&CK technique T1496 Resource Hijacking, specifically sub-technique T1496.001 CPU or Memory Exhaustion via Algorithmic Complexity Attacks. The attacker leverages the legitimate functionality of XML signature validation to exhaust system resources, a common pattern in application-layer denial-of-service attacks that bypass traditional network-level rate limiting by appearing as valid authentication traffic until processing begins.
The mitigation strategy implemented in the fixed versions 4.19.3 and 4.20.3 addresses these issues through multiple layers of defense. First, the library limits the number of transforms allowed within a single signature validation chain to prevent deep nesting that could lead to excessive resource usage. Second, it enforces strict allowlisting by permitting only those transform algorithms explicitly identified as valid by the SAML 2.0 Core specification. Most critically, the fix specifically rejects XPath-based transforms entirely during signature verification. By removing support for dynamic XPath evaluation in this context, the library eliminates the vector through which attackers could inject complex logic to trigger resource exhaustion. Organizations utilizing SimpleSAMLphp must upgrade immediately to version 4.19.3 or later if they are on the 4.19.x branch, or to version 4.20.3 or later if they are on the 4.20.x branch. Until this patch is applied, administrators should consider implementing strict input validation at the network perimeter and monitoring for unusual spikes in CPU usage associated with SAML endpoint traffic as a temporary compensating control.