Executive brief
SimpleSAMLphp is a widely used tool for managing digital identities and single sign-on (SSO). A security flaw in how it handles certain login requests allows a malicious or lower-trust identity provider to impersonate users from a different, more trusted provider. This could allow an attacker to gain unauthorized access to sensitive corporate systems by forging user identities.
Technical details
A vulnerability exists in the HTTP-Artifact receive path of SimpleSAMLphp where TLS validator confusion occurs. In the `HTTPArtifact::receive()` flow, the `SOAPClient::validateSSL()` method fails to throw an exception when a TLS public key mismatch occurs, returning normally instead. Because `SAML2\Message::validate()` interprets any non-exception return as a successful validation, an unsigned SAML Response embedded in a SOAP ArtifactResponse from one IdP can be incorrectly validated against the metadata of a different IdP. This allows a malicious IdP to mint assertions for arbitrary users belonging to a higher-trust IdP within the same federation. The issue is patched in versions 6.2.1, 5.0.6, and 4.20.2.
Affected products
- SimpleSAMLphp saml2 >= 6.0.0, < 6.2.1; >= 5.0.0, < 5.0.6; < 4.20.2
- SimpleSAMLphp saml2-legacy < 4.20.2
Timeline
- 2026-05-29: disclosed
- 2026-07-02: advisory