Is CVE-2026-46491 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46491 being exploited in the wild.

How severe is CVE-2026-46491?

High severity, with a CVSS score of 8.6, published 10 June 2026.

Which products and versions are affected?

simplesamlphp/simplesamlphp-module-casserver (Packagist) <= 7.0.2, ECOSYSTEM:introduced=0,fixed=7.0.3; Simplesamlphp CAS Server Module <= 7.0.2; Simplesamlphp Casserver Module <= 7.0.2.

Is there a fix for CVE-2026-46491?

Yes. simplesamlphp/simplesamlphp-module-casserver (Packagist): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46491 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-46491?

Check whether you run simplesamlphp/simplesamlphp-module-casserver (Packagist), Simplesamlphp CAS Server Module or Simplesamlphp Casserver Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46491: SimpleSAMLphp-casserver path traversal in FileSystemTicketStore

Q: Is there a fix for CVE-2026-46491?

Yes. simplesamlphp/simplesamlphp-module-casserver (Packagist): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-46491 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-46491?

Check whether you run simplesamlphp/simplesamlphp-module-casserver (Packagist), Simplesamlphp CAS Server Module or Simplesamlphp Casserver Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46491 · Severity: high · CVSS 8.6 · Published 2026-06-10

A vulnerability in the SimpleSAMLphp CAS server module allows unauthorized users to access or delete files on the server. This module is used to handle authentication requests, and an attacker could exploit this to disrupt login services or delete critical system files. In some cases, this could lead to a complete service outage or unauthorized access to sensitive configuration data.

Vendors: Packagist, Simplesamlphp.

Quick answers

Is CVE-2026-46491 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46491 being exploited in the wild.
How severe is CVE-2026-46491?: High severity, with a CVSS score of 8.6, published 10 June 2026.
Which products and versions are affected?: simplesamlphp/simplesamlphp-module-casserver (Packagist) <= 7.0.2, ECOSYSTEM:introduced=0,fixed=7.0.3; Simplesamlphp CAS Server Module <= 7.0.2; Simplesamlphp Casserver Module <= 7.0.2.
Is there a fix for CVE-2026-46491?: Yes. simplesamlphp/simplesamlphp-module-casserver (Packagist): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46491 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-46491?: Check whether you run simplesamlphp/simplesamlphp-module-casserver (Packagist), Simplesamlphp CAS Server Module or Simplesamlphp Casserver Module at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

simplesamlphp/simplesamlphp-module-casserver (Packagist): upgrade to 7.0.3 or later
```
composer require simplesamlphp/simplesamlphp-module-casserver:^7.0.3
```

Technical details

A path traversal vulnerability exists in the `FileSystemTicketStore` component of the `simplesamlphp-module-casserver`. The root cause is the direct concatenation of attacker-controlled ticket identifiers from query parameters (`ticket` or `pgt`) with the configured ticket directory. A remote, unauthenticated attacker can use `../` sequences to access files outside the intended directory. If the target file contains valid PHP serialized data, the server will unserialize it; in CAS 1.0 flows, the server may also delete the file if it matches specific return type criteria. This can lead to arbitrary file deletion or potentially remote code execution if an attacker can influence the content of the files being unserialized. The issue is fixed in version 7.0.3.

Affected products

SimpleSAMLphp simplesamlphp-module-casserver <= 7.0.2

Identifiers

CVE-2026-46491
GHSA-jrrg-99xh-5j2q

Timeline

2026-05-14: patched: Version 7.0.3 released
2026-05-15: advisory: GitHub Advisory published
2026-06-10: disclosed: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.