SimpleSAMLphp saml2 up to 4.16.x/5.0.0-alpha.19 Signed SAMLResponse signature verification

Summaryinfo

A vulnerability was found in SimpleSAMLphp saml2 up to 4.16.x/5.0.0-alpha.19. It has been classified as problematic. This vulnerability affects unknown code of the component Signed SAMLResponse Handler. The manipulation leads to signature verification. This vulnerability is listed as CVE-2025-27773. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SimpleSAMLphp saml2 up to 4.16.x/5.0.0-alpha.19. This issue affects an unknown code block of the component Signed SAMLResponse Handler. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is integrity. The summary by CVE is:

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2025-27773 since 03/06/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 235669 (Debian dla-4161 : simplesamlphp - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.17.0 or 5.0.0-alpha.20 eliminates this vulnerability. Applying the patch 7867d6099dc7f31bed1ea10e5bea159c5623d2a0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (235669). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• SimpleSAMLphp

Name

• saml2

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8
• 4.9
• 4.10
• 4.11
• 4.12
• 4.13
• 4.14
• 4.15
• 4.16
• 5.0.0-alpha.0
• 5.0.0-alpha.1
• 5.0.0-alpha.2
• 5.0.0-alpha.3
• 5.0.0-alpha.4
• 5.0.0-alpha.5
• 5.0.0-alpha.6
• 5.0.0-alpha.7
• 5.0.0-alpha.8
• 5.0.0-alpha.9
• 5.0.0-alpha.10
• 5.0.0-alpha.11
• 5.0.0-alpha.12
• 5.0.0-alpha.13
• 5.0.0-alpha.14
• 5.0.0-alpha.15
• 5.0.0-alpha.16
• 5.0.0-alpha.17
• 5.0.0-alpha.18
• 5.0.0-alpha.19

License

• open-source

Website

• Product: https://github.com/simplesamlphp/saml2/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion