CVE-2025-27773
published 2025-03-11CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion…
PriorityP346high8.6CVSS 3.1
AVNACLPRNUINSCCNIHAN
EPSS
0.30%
21.6th percentile
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | simplesamlphp | < simplesamlphp 1.19.7-1+deb12u2 (bookworm) | simplesamlphp 1.19.7-1+deb12u2 (bookworm) |
| simplesamlphp | saml2 | < 4.17.0 | 4.17.0 |
| simplesamlphp | saml2 | — | — |
| simplesamlphp | saml2 | >= 0 < 4.17.0 | 4.17.0 |
| simplesamlphp | saml2 | >= 5.0.0-alpha.1 < 5.0.0-alpha.20 | 5.0.0-alpha.20 |
| simplesamlphp | saml2-legacy | >= 0 < 4.17.0 | 4.17.0 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.0-1+deb11u2 | 1.19.0-1+deb11u2 |
| simplesamlphp | simplesamlphp | >= 0 < 1.19.7-1+deb12u2 | 1.19.7-1+deb12u2 |
CVSS provenance
nvdv3.18.6HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
osv8.6HIGH
vendor_debian8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2025-27773: simplesamlphp - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality...
vendor_debian·2025·CVSS 8.6
CVE-2025-27773 [HIGH] CVE-2025-27773: simplesamlphp - The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality...
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
Scope: local
bookworm: resolved (fixed in 1.19.7-1+deb12u2)
bullseye: resolved (fixed in 1.19.0-1+deb11u2)
sid: resolved (fixed in 1.19.7-2)
OSV
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
osv·2025-03-11
CVE-2025-27773 [HIGH] The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
### Summary
There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.
I believe that it exists for v4 only. I have not yet developed a PoC.
V5 is well designed and instead builds the signed query from the same message that will be consumed.
### Details
#### What is verified
The data['SignedQuery'] is the string that will be verified by the public key.
It is defined here:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
THe code will iterate through each parameter name. Notably, sigQuery is
OSV
CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
osv·2025-03-11·CVSS 8.6
CVE-2025-27773 [HIGH] CVE-2025-27773: The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
GHSA
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
ghsa·2025-03-11
CVE-2025-27773 [HIGH] CWE-347 The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
### Summary
There's a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message.
I believe that it exists for v4 only. I have not yet developed a PoC.
V5 is well designed and instead builds the signed query from the same message that will be consumed.
### Details
#### What is verified
The data['SignedQuery'] is the string that will be verified by the public key.
It is defined here:
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
THe code will iterate through each parameter name. Notably, sigQuery is
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217https://github.com/simplesamlphp/saml2/commit/7867d6099dc7f31bed1ea10e5bea159c5623d2a0https://github.com/simplesamlphp/saml2/security/advisories/GHSA-46r4-f8gj-xg56https://lists.debian.org/debian-lts-announce/2025/05/msg00013.html
2025-03-11
Published