# simplesamlphp/simplesamlphp (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/simplesamlphp-simplesamlphp Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/simplesamlphp-simplesamlphp.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in simplesamlphp/simplesamlphp (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-49284, was published on 17 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 25 (0 critical, 0 exploited in the wild) ## About simplesamlphp/simplesamlphp (Packagist) An open-source PHP authentication and federation application that supports SAML 2.0. ## Latest simplesamlphp/simplesamlphp (Packagist) vulnerabilities - [CVE-2026-49284: SimpleSAMLphp authentication bypass in SAML SP ACS path](https://junglewise.ai/threats/cve-2026-49284-simplesamlphp-authentication-bypass-in-saml-sp-acs-path) (high, CVSS 7.1, published 17 Jul 2026) - [SimpleSAMLphp vulnerable to XXE in parsing SAML messages](https://junglewise.ai/threats/simplesamlphp-vulnerable-to-xxe-in-parsing-saml-messages-e65d95cd) (low, CVSS 3.1, published 2 Dec 2024) - [SimpleSAMLphp Information Disclosure vulnerability](https://junglewise.ai/threats/simplesamlphp-information-disclosure-vulnerability-07de5cdd) (low, CVSS 3.1, published 28 May 2024) - [SimpleSAMLphp Reflected Cross-site Scripting vulnerability](https://junglewise.ai/threats/simplesamlphp-reflected-cross-site-scripting-vulnerability-76196f28) (low, CVSS 3.1, published 28 May 2024) - [Duplicate Advisory: SimpleSAMLphp signature validation bypass](https://junglewise.ai/threats/duplicate-advisory-simplesamlphp-signature-validation-bypass-85859e99) (info, published 28 May 2024) - [SimpleSAMLphp exposes credentials in session storage](https://junglewise.ai/threats/simplesamlphp-exposes-credentials-in-session-storage-0757537a) (low, CVSS 3.1, published 28 May 2024) - [SimpleSAMLphp Link Injection vulnerability](https://junglewise.ai/threats/simplesamlphp-link-injection-vulnerability-fff04b79) (low, CVSS 3.1, published 28 May 2024) - [CVE-2017-12870: SimpleSAMLphp Unauthenticated encryption in CBC mode](https://junglewise.ai/threats/cve-2017-12870-simplesamlphp-unauthenticated-encryption-in-cbc-mode) (low, CVSS 3, published 17 May 2022) - [CVE-2017-12871: SimpleSAMLphp Incorrect IV generation for encryption](https://junglewise.ai/threats/cve-2017-12871-simplesamlphp-incorrect-iv-generation-for-encryption) (low, CVSS 3, published 17 May 2022) - [CVE-2018-6520: SimpleSAMLphp Open redirection protection bypass](https://junglewise.ai/threats/cve-2018-6520-simplesamlphp-open-redirection-protection-bypass) (low, CVSS 3, published 14 May 2022) - [CVE-2017-12868: SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module](https://junglewise.ai/threats/cve-2017-12868-simplesamlphp-session-fixation-issue-and-authentication-bypass-in) (low, CVSS 3, published 14 May 2022) - [CVE-2016-3124: SimpleSAMLphp Information leakage issue in the sanitycheck module](https://junglewise.ai/threats/cve-2016-3124-simplesamlphp-information-leakage-issue-in-the-sanitycheck-module) (low, CVSS 3, published 14 May 2022) - [CVE-2017-12869: SimpleSAMLphp Authentication context bypass in the multiauth module](https://junglewise.ai/threats/cve-2017-12869-simplesamlphp-authentication-context-bypass-in-the-multiauth) (low, CVSS 3, published 14 May 2022) - [CVE-2017-18121: SimpleSAMLphp XSS Vulnerability](https://junglewise.ai/threats/cve-2017-18121-simplesamlphp-xss-vulnerability) (low, CVSS 3, published 14 May 2022) - [CVE-2017-18122: SimpleSAMLphp Signature validation bypass](https://junglewise.ai/threats/cve-2017-18122-simplesamlphp-signature-validation-bypass) (low, CVSS 3, published 14 May 2022) - [CVE-2017-12872: SimpleSAMLphp allows timing side-channel attacks](https://junglewise.ai/threats/cve-2017-12872-simplesamlphp-allows-timing-side-channel-attacks) (low, CVSS 3, published 14 May 2022) - [CVE-2018-6521: SimpleSAMLphp Use of insecure connection charset (sqlauth module)](https://junglewise.ai/threats/cve-2018-6521-simplesamlphp-use-of-insecure-connection-charset-sqlauth-module) (low, CVSS 3, published 13 May 2022) - [CVE-2017-12867: SimpleSAMLphp Invalid token creation and validation](https://junglewise.ai/threats/cve-2017-12867-simplesamlphp-invalid-token-creation-and-validation) (low, CVSS 3, published 13 May 2022) - [CVE-2011-4625: simpleSAMLphp incorrectly handles XML encryption](https://junglewise.ai/threats/cve-2011-4625-simplesamlphp-incorrectly-handles-xml-encryption) (low, CVSS 3.1, published 22 Apr 2022) - [CVE-2020-5301: Information disclosure of source code in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5301-information-disclosure-of-source-code-in-simplesamlphp) (low, CVSS 3.1, published 22 Apr 2020) - [CVE-2017-12873: Incorrect persistent NameID generation in SimpleSAMLphp](https://junglewise.ai/threats/cve-2017-12873-incorrect-persistent-nameid-generation-in-simplesamlphp) (low, CVSS 3, published 24 Jan 2020) - [CVE-2016-9955: Incorrect signature verification in SimpleSAMLphp](https://junglewise.ai/threats/cve-2016-9955-incorrect-signature-verification-in-simplesamlphp) (low, CVSS 3, published 24 Jan 2020) - [Link injection in SimpleSAMLphp](https://junglewise.ai/threats/link-injection-in-simplesamlphp-790b72de) (low, CVSS 3.1, published 24 Jan 2020) - [CVE-2020-5226: Cross-site scripting in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5226-cross-site-scripting-in-simplesamlphp) (low, CVSS 3.1, published 24 Jan 2020) - [CVE-2020-5225: Log injection in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5225-log-injection-in-simplesamlphp) (low, CVSS 3.1, published 24 Jan 2020) ## Most severe simplesamlphp/simplesamlphp (Packagist) vulnerabilities - [CVE-2026-49284: SimpleSAMLphp authentication bypass in SAML SP ACS path](https://junglewise.ai/threats/cve-2026-49284-simplesamlphp-authentication-bypass-in-saml-sp-acs-path) (high, CVSS 7.1, published 17 Jul 2026) - [CVE-2020-5301: Information disclosure of source code in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5301-information-disclosure-of-source-code-in-simplesamlphp) (low, CVSS 3.1, published 22 Apr 2020) - [CVE-2011-4625: simpleSAMLphp incorrectly handles XML encryption](https://junglewise.ai/threats/cve-2011-4625-simplesamlphp-incorrectly-handles-xml-encryption) (low, CVSS 3.1, published 22 Apr 2022) - [CVE-2020-5225: Log injection in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5225-log-injection-in-simplesamlphp) (low, CVSS 3.1, published 24 Jan 2020) - [CVE-2020-5226: Cross-site scripting in SimpleSAMLphp](https://junglewise.ai/threats/cve-2020-5226-cross-site-scripting-in-simplesamlphp) (low, CVSS 3.1, published 24 Jan 2020) - [SimpleSAMLphp vulnerable to XXE in parsing SAML messages](https://junglewise.ai/threats/simplesamlphp-vulnerable-to-xxe-in-parsing-saml-messages-e65d95cd) (low, CVSS 3.1, published 2 Dec 2024) - [SimpleSAMLphp Information Disclosure vulnerability](https://junglewise.ai/threats/simplesamlphp-information-disclosure-vulnerability-07de5cdd) (low, CVSS 3.1, published 28 May 2024) - [SimpleSAMLphp Reflected Cross-site Scripting vulnerability](https://junglewise.ai/threats/simplesamlphp-reflected-cross-site-scripting-vulnerability-76196f28) (low, CVSS 3.1, published 28 May 2024) - [SimpleSAMLphp exposes credentials in session storage](https://junglewise.ai/threats/simplesamlphp-exposes-credentials-in-session-storage-0757537a) (low, CVSS 3.1, published 28 May 2024) - [SimpleSAMLphp Link Injection vulnerability](https://junglewise.ai/threats/simplesamlphp-link-injection-vulnerability-fff04b79) (low, CVSS 3.1, published 28 May 2024) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "simplesamlphp/simplesamlphp (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/simplesamlphp-simplesamlphp, 9 November 2026.