# CVE-2026-49284: SimpleSAMLphp authentication bypass in SAML SP ACS path

Source: https://junglewise.ai/threats/cve-2026-49284-simplesamlphp-authentication-bypass-in-saml-sp-acs-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-49284 · Severity: high · CVSS 7.1 · Published 2026-07-17

SimpleSAMLphp is a widely used tool for managing single sign-on (SSO) logins. A security flaw allows a user to log in using a different identity provider than the one specifically requested by the application. In environments that trust multiple login sources, this could allow an attacker to bypass intended security boundaries or access controls by using a less-secure login provider to impersonate a user on a more-secure one.

Technologies: [simplesamlphp/simplesamlphp (Packagist)](https://junglewise.ai/threats/technologies/simplesamlphp-simplesamlphp). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Simplesamlphp](https://junglewise.ai/threats/vendors/simplesamlphp).

## Quick answers

**Is CVE-2026-49284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49284 being exploited in the wild.

**How severe is CVE-2026-49284?** High severity, with a CVSS score of 7.1, published 17 July 2026.

**Which products and versions are affected?** simplesamlphp/simplesamlphp (Packagist) ECOSYSTEM:introduced=2.5.0,fixed=2.5.2; Simplesamlphp < 1.18.6, < 2.4.7, >= 2.5.0-rc1 < 2.5.2, >= 2.5.0, <= 2.5.1.

**Is there a fix for CVE-2026-49284?** Yes. simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49284 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-49284?** Check whether you run simplesamlphp/simplesamlphp (Packagist) or Simplesamlphp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- simplesamlphp/simplesamlphp (Packagist): upgrade to 2.5.2 or later

  ```sh
  composer require simplesamlphp/simplesamlphp:^2.5.2
  ```


## Technical details

The vulnerability exists in SimpleSAMLphp's SAML Service Provider (SP) Assertion Consumer Service (ACS) path. When an unsigned 'Response/InResponseTo' element is combined with a signed assertion that lacks 'SubjectConfirmationData/InResponseTo', the SP fails to verify that the responding Identity Provider (IdP) matches the 'ExpectedIssuer' stored in the SP state. Instead of rejecting the mismatch, the system logs a warning and continues processing. This allows a response from one trusted IdP to be bound to a session initiated for a different IdP, potentially bypassing IdP-specific routing or 'enable_unsolicited' restrictions. This is particularly critical in multi-tenant environments where different IdPs have different assurance levels. The issue is fixed in versions 1.18.6, 2.4.7, and 2.5.2.

## Affected products

- SimpleSAMLphp SimpleSAMLphp < 1.18.6, < 2.4.7, >= 2.5.0-rc1 < 2.5.2

## Identifiers

- CVE-2026-49284
- GHSA-q8r6-xj3f-wrrm

## Timeline

- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-06-01: patched: Versions 2.4.7 and 2.5.2 released
- 2026-07-17: disclosed: CVE-2026-49284 published to NVD

## References

- [https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.4.7](https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.4.7)
- [https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.5.2](https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.5.2)
- [https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-q8r6-xj3f-wrrm](https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-q8r6-xj3f-wrrm)

## Related threats

- [SimpleSAMLphp vulnerable to XXE in parsing SAML messages](https://junglewise.ai/threats/simplesamlphp-vulnerable-to-xxe-in-parsing-saml-messages-e65d95cd)
- [SimpleSAMLphp Information Disclosure vulnerability](https://junglewise.ai/threats/simplesamlphp-information-disclosure-vulnerability-07de5cdd)
- [SimpleSAMLphp Reflected Cross-site Scripting vulnerability](https://junglewise.ai/threats/simplesamlphp-reflected-cross-site-scripting-vulnerability-76196f28)
- [Duplicate Advisory: SimpleSAMLphp signature validation bypass](https://junglewise.ai/threats/duplicate-advisory-simplesamlphp-signature-validation-bypass-85859e99)
- [SimpleSAMLphp exposes credentials in session storage](https://junglewise.ai/threats/simplesamlphp-exposes-credentials-in-session-storage-0757537a)