CVE-2026-49289: SimpleSAMLphp saml2 Denial of Service via XPath Transform

CVE-2026-49289 · Severity: high · CVSS 7.5 · Published 2026-07-02

SimpleSAMLphp, a library used for single sign-on (SSO) authentication, is vulnerable to a denial-of-service attack. An attacker can send specially crafted messages that overwhelm the system, potentially causing the authentication service to become unavailable to legitimate users. This could disrupt access to corporate applications and services that rely on this library for user logins.

Technologies: simplesamlphp/saml2 (Packagist), simplesamlphp/saml2-legacy (Packagist). Vendors: Packagist, Simplesamlphp.

Quick answers

Is CVE-2026-49289 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49289 being exploited in the wild.
How severe is CVE-2026-49289?
High severity, with a CVSS score of 7.5, published 2 July 2026.
Which products and versions are affected?
simplesamlphp/saml2 (Packagist) <= 4.20.2, ECOSYSTEM:introduced=4.20.0,fixed=4.20.3; simplesamlphp/saml2-legacy (Packagist) <= 4.20.2, ECOSYSTEM:introduced=4.20.0,fixed=4.20.3; Simplesamlphp Saml2 <= 4.20.2; Simplesamlphp Saml2-Legacy <= 4.20.2.
Is there a fix for CVE-2026-49289?
Yes. simplesamlphp/saml2 (Packagist): upgrade to 4.20.3 or later; simplesamlphp/saml2-legacy (Packagist): upgrade to 4.20.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49289 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-49289?
Check whether you run simplesamlphp/saml2 (Packagist), simplesamlphp/saml2-legacy (Packagist), Simplesamlphp Saml2 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • simplesamlphp/saml2 (Packagist): upgrade to 4.20.3 or later
    composer require simplesamlphp/saml2:^4.20.3
  • simplesamlphp/saml2-legacy (Packagist): upgrade to 4.20.3 or later
    composer require simplesamlphp/saml2-legacy:^4.20.3

Technical details

A Denial-of-Service (DoS) vulnerability exists in the SimpleSAMLphp saml2 library due to uncontrolled resource consumption during the processing of XPath transforms. The library failed to properly restrict the number and type of XML transforms allowed in SAML messages. A remote, unauthenticated attacker can exploit this by sending specially crafted SAML messages containing complex XPath transforms, leading to CPU or memory exhaustion (CWE-400). The issue has been mitigated in version 4.20.3 by restricting transform algorithms to those defined in the SAML 2.0 Core Specifications and explicitly disabling XPath transforms.

Affected products

  • SimpleSAMLphp saml2 <= 4.20.2
  • SimpleSAMLphp saml2-legacy <= 4.20.2

Identifiers

  • CVE-2026-49289
  • GHSA-5cjr-mxj5-wmrx

Timeline

  • 2026-05-29: disclosed: Advisory published by maintainers
  • 2026-07-02: advisory: GitHub Advisory Database entry published
  • 2026-05-29: patched: Version 4.20.3 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.