Simplesamlphp/saml2

This hub aggregates every CVE we track for Simplesamlphp/saml2, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 7 most recently published vulnerabilities affecting Simplesamlphp/saml2.

• CVE-2025-27773SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding8.6Mar 11, 2025
• CVE-2024-52806SimpleSAMLphp SAML2 has an XXE in parsing SAML messages8.3Dec 2, 2024
• CVE-2023-49087Validation of SignedInfo6.8Nov 30, 2023
• CVE-2018-7711HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures ac...8.1Mar 5, 2018
• CVE-2018-7644The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML asserti...7.5Mar 5, 2018
• CVE-2018-6519The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.7.5Feb 2, 2018
• CVE-2016-9814The validateSignature method in the SAML2\Utils class in SimpleSAMLphp before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before 1.10.3, and 2.x before 2.3.3 allows remote attacker...9.1Feb 16, 2017