CVE-2025-27773
published 2025-03-11CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion…
PriorityP346high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.41%
34.8th percentile
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | simplesamlphp | < simplesamlphp 1.19.7-1+deb12u2 (bookworm) | simplesamlphp 1.19.7-1+deb12u2 (bookworm) |
| simplesamlphp | saml2 | < 4.17.0 | 4.17.0 |
| simplesamlphp | saml2 | — | — |
| simplesamlphp | saml2 | >= 0 < 4.17.0 | 4.17.0 |
| simplesamlphp | saml2 | >= 5.0.0-alpha.1 < 5.0.0-alpha.20 | 5.0.0-alpha.20 |
| simplesamlphp | saml2-legacy | >= 0 < 4.17.0 | 4.17.0 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.0-1+deb11u2 | 1.19.0-1+deb11u2 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.7-1+deb12u2 | 1.19.7-1+deb12u2 |
| ubuntu | simplesamlphp | — | — |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
osv8.6HIGH
vendor_ubuntu8.8HIGH
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
SimpleSAMLphp vulnerabilities
vendor_ubuntu·2026-09-15·CVSS 8.8
CVE-2024-52596 [HIGH] SimpleSAMLphp vulnerabilities
Title: SimpleSAMLphp vulnerabilities
Summary: Several security issues were fixed in SimpleSAMLphp.
It was discovered that SimpleSAMLphp incorrectly validated cryptographic
signatures in XML messages. An authenticated attacker could possibly use
this issue to impersonate users or gain elevated privileges. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-3465)
It was discovered that SimpleSAMLphp incorrectly handled external entities
when parsing untrusted XML documents. A remote attacker could possibly use
this issue to obtain sensitive information. This issue did not affect
Ubuntu 24.04 LTS. (CVE-2024-52596)
It was discovered that SimpleSAMLphp incorrectly verified signatures in
SAML messages using the HTTP-Redirect binding. A remote attacker could
possibly use
Debian
CVE-2025-27773: simplesamlphp - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality...
vendor_debian·2025·CVSS 8.6
CVE-2025-27773 [HIGH] CVE-2025-27773: simplesamlphp - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality...
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
Scope: local
bookworm: resolved (fixed in 1.19.7-1+deb12u2)
bullseye: resolved (fixed in 1.19.0-1+deb11u2)
sid: resolved (fixed in 1.19.7-2)
OSV
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
osv·2025-03-11
CVE-2025-27773 [HIGH] The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
### Summary
There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.
I believe that it exists for v4 only. I have not yet developed a PoC.
V5 is well designed and instead builds the signed query from the same message that will be consumed.
### Details
#### What is verified
The data['SignedQuery'] is the string that will be verified by the public key.
It is defined here:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
THe code will iterate through each parameter name. Notably, sigQuery is
OSV
CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
osv·2025-03-11·CVSS 8.6
CVE-2025-27773 [HIGH] CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
GHSA
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
ghsa·2025-03-11
CVE-2025-27773 [HIGH] CWE-347 The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
### Summary
There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.
I believe that it exists for v4 only. I have not yet developed a PoC.
V5 is well designed and instead builds the signed query from the same message that will be consumed.
### Details
#### What is verified
The data['SignedQuery'] is the string that will be verified by the public key.
It is defined here:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
THe code will iterate through each parameter name. Notably, sigQuery is
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217https://github.com/simplesamlphp/saml2/commit/7867d6099dc7f31bed1ea10e5bea159c5623d2a0https://github.com/simplesamlphp/saml2/security/advisories/GHSA-46r4-f8gj-xg56https://lists.debian.org/debian-lts-announce/2025/05/msg00013.html
2025-03-11
Published