Executive brief
SimpleSAMLphp is a widely used tool for managing single sign-on (SSO) logins. A security flaw allows a user to log in using a different identity provider than the one specifically requested by the application. In environments that trust multiple login sources, this could allow an attacker to bypass intended security boundaries or access controls by using a less-secure login provider to impersonate a user on a more-secure one.
Technical details
The vulnerability exists in SimpleSAMLphp's SAML Service Provider (SP) Assertion Consumer Service (ACS) path. When an unsigned 'Response/InResponseTo' element is combined with a signed assertion that lacks 'SubjectConfirmationData/InResponseTo', the SP fails to verify that the responding Identity Provider (IdP) matches the 'ExpectedIssuer' stored in the SP state. Instead of rejecting the mismatch, the system logs a warning and continues processing. This allows a response from one trusted IdP to be bound to a session initiated for a different IdP, potentially bypassing IdP-specific routing or 'enable_unsolicited' restrictions. This is particularly critical in multi-tenant environments where different IdPs have different assurance levels. The issue is fixed in versions 1.18.6, 2.4.7, and 2.5.2.
Affected products
- SimpleSAMLphp SimpleSAMLphp < 1.18.6, < 2.4.7, >= 2.5.0-rc1 < 2.5.2
Timeline
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-06-01: patched: Versions 2.4.7 and 2.5.2 released
- 2026-07-17: disclosed: CVE-2026-49284 published to NVD