CVE-2026-49289

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-400"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49289.json"
}

References

Affected packages

Git / github.com/simplesamlphp/saml2

Affected ranges

Type

GIT

Repo

https://github.com/simplesamlphp/saml2

Events

Introduced

93df4bffc052939e74ec0c1208e66cbd7eb2a1b2

Introduced

8e76ef75ce44015f336a6a905e08a0d17616a0e2

Fixed

d5c213132ef671c0018a11252322034dbddd735a

Fixed

dfaa73a8293bf274be4c64c7fe8dcc048642e354

Fixed

0043033891fdba9618386ab583e1d8afdf8aea6e

Fixed

6695eb923da491f716009c2a26b34a463ac05c6b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.19.2"
        },
        {
            "fixed": "4.19.3"
        },
        {
            "introduced": "4.20.2"
        },
        {
            "fixed": "4.20.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v4.*

v4.19.2

v4.20.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49289.json"