Is CVE-2026-49284 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49284 being exploited in the wild.

How severe is CVE-2026-49284?

High severity, with a CVSS score of 7.1, published 17 July 2026.

Which products and versions are affected?

simplesamlphp/simplesamlphp (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.5.2; Simplesamlphp = 2.5.0-rc1 = 2.5.0, <= 2.5.1.

Is there a fix for CVE-2026-49284?

Yes. simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49284 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49284?

Check whether you run simplesamlphp/simplesamlphp (Packagist) or Simplesamlphp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49284: SimpleSAMLphp authentication bypass in SAML SP ACS path

Q: Is there a fix for CVE-2026-49284?

Yes. simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49284 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49284?

Check whether you run simplesamlphp/simplesamlphp (Packagist) or Simplesamlphp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49284 · Severity: high · CVSS 7.1 · Published 2026-07-17

SimpleSAMLphp is a widely used tool for managing single sign-on (SSO) logins. A security flaw allows a user to log in using a different identity provider than the one specifically requested by the application. In environments that trust multiple login sources, this could allow an attacker to bypass intended security boundaries or access controls by using a less-secure login provider to impersonate a user on a more-secure one.

Technologies: simplesamlphp/simplesamlphp (Packagist). Vendors: Packagist, Simplesamlphp.

Quick answers

Is CVE-2026-49284 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49284 being exploited in the wild.
How severe is CVE-2026-49284?: High severity, with a CVSS score of 7.1, published 17 July 2026.
Which products and versions are affected?: simplesamlphp/simplesamlphp (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.5.2; Simplesamlphp < 1.18.6, < 2.4.7, >= 2.5.0-rc1 < 2.5.2, >= 2.5.0, <= 2.5.1.
Is there a fix for CVE-2026-49284?: Yes. simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49284 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49284?: Check whether you run simplesamlphp/simplesamlphp (Packagist) or Simplesamlphp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later
```
composer require simplesamlphp/simplesamlphp:^2.5.2
```

Technical details

The vulnerability exists in SimpleSAMLphp's SAML Service Provider (SP) Assertion Consumer Service (ACS) path. When an unsigned 'Response/InResponseTo' element is combined with a signed assertion that lacks 'SubjectConfirmationData/InResponseTo', the SP fails to verify that the responding Identity Provider (IdP) matches the 'ExpectedIssuer' stored in the SP state. Instead of rejecting the mismatch, the system logs a warning and continues processing. This allows a response from one trusted IdP to be bound to a session initiated for a different IdP, potentially bypassing IdP-specific routing or 'enable_unsolicited' restrictions. This is particularly critical in multi-tenant environments where different IdPs have different assurance levels. The issue is fixed in versions 1.18.6, 2.4.7, and 2.5.2.

Affected products

SimpleSAMLphp SimpleSAMLphp < 1.18.6, < 2.4.7, >= 2.5.0-rc1 < 2.5.2

Identifiers

CVE-2026-49284
GHSA-q8r6-xj3f-wrrm

Timeline

2026-05-29: advisory: GitHub Security Advisory published
2026-06-01: patched: Versions 2.4.7 and 2.5.2 released
2026-07-17: disclosed: CVE-2026-49284 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.