SimpleSAMLphp up to 2.4.6/2.5.1 ACS information disclosure

Summaryinfo

A vulnerability was found in SimpleSAMLphp up to 2.4.6/2.5.1. It has been declared as problematic. The affected element is an unknown function of the component ACS. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-49284. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in SimpleSAMLphp up to 2.4.6/2.5.1. It has been declared as problematic. This vulnerability affects some unknown processing of the component ACS. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-49284 since 05/28/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 2.4.7 or 2.5.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• SimpleSAMLphp

Version

• 2.4.0
• 2.4.1
• 2.4.2
• 2.4.3
• 2.4.4
• 2.4.5
• 2.4.6
• 2.5.0
• 2.5.1

License

• open-source

Website

• Product: https://github.com/simplesamlphp/simplesamlphp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion