GHSA-6929-8p9f-26jx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-6929-8p9f-26jx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-6929-8p9f-26jx/GHSA-6929-8p9f-26jx.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-6929-8p9f-26jx
- Aliases
- Published
- 2026-07-02T20:25:56Z
- Modified
- 2026-08-04T21:30:19Z
- Severity
-
- 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass
- Details
-
Summary
SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML
Responseas cryptographically valid for the wrong IdP.In the
HTTPArtifact::receive()flow, the SOAPArtifactResponsereceives a TLS-based validator fromSOAPClient::addSSLValidator(). The embedded SAMLResponsethen receives a validator that delegates signature validation to that outerArtifactResponse. Later, the SP validates the embeddedResponseagainst metadata selected from the embedded response issuer, not necessarily the artifact issuer.The critical issue is that
SOAPClient::validateSSL()returns normally when the TLS public key does not match the key currently being validated.SAML2\Message::validate()treats any validator call that does not throw an exception as successful. As a result, anArtifactResponseobtained from one IdP can validate an unsigned embedded SAMLResponsethat claims to be issued by a different IdP.In a multi-IdP/federation deployment where a malicious or lower-trust IdP can issue an HTTP-Artifact response to an SP, this can allow the attacker to authenticate to the SP as arbitrary users from a higher-trust victim IdP.
Impact
A malicious or lower-trust IdP in the same SP/federation trust set can authenticate to the SP as users from another IdP when HTTP-Artifact is used. The attacker can choose assertion attributes,
NameID, and session data in the forged unsigned assertion.This is an authentication bypass and identity-provider impersonation issue. In realistic federations, the security boundary between IdPs matters: a compromised or low-assurance IdP should not be able to mint identities for a high-assurance IdP.
- Database specific
{ "cwe_ids": [ "CWE-295" ], "github_reviewed": true, "github_reviewed_at": "2026-07-02T20:25:56Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Packagist
simplesamlphp/saml2
Package
- Name
- simplesamlphp/saml2
- Purl
- pkg:composer/simplesamlphp/saml2
simplesamlphp/saml2
Package
- Name
- simplesamlphp/saml2
- Purl
- pkg:composer/simplesamlphp/saml2
simplesamlphp/saml2
Package
- Name
- simplesamlphp/saml2
- Purl
- pkg:composer/simplesamlphp/saml2
simplesamlphp/saml2-legacy
Package
- Name
- simplesamlphp/saml2-legacy
- Purl
- pkg:composer/simplesamlphp/saml2-legacy
simplesamlphp/saml2
Package
- Name
- simplesamlphp/saml2
- Purl
- pkg:composer/simplesamlphp/saml2
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.19.3
Affected versions
v0.*
v1.*
v2.*
v3.*
v4.*
4.*
simplesamlphp/saml2-legacy
Package
- Name
- simplesamlphp/saml2-legacy
- Purl
- pkg:composer/simplesamlphp/saml2-legacy
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed4.19.3