EUVD-2026-62502
GHSA-6929-8p9f-26jx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Attacker must hold a trusted federation IdP position (PR:H) to send network Artifact responses; impersonation crosses the SP trust boundary (S:C) with high C/I and no availability impact.
Primary rating from Vendor (https://github.com/simplesamlphp/saml2).
CVSS VectorVendor: https://github.com/simplesamlphp/saml2
Lifecycle Timeline
1DescriptionCVE.org
Summary
SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML Response as cryptographically valid for the wrong IdP.
In the HTTPArtifact::receive() flow, the SOAP ArtifactResponse receives a TLS-based validator from SOAPClient::addSSLValidator(). The embedded SAML Response then receives a validator that delegates signature validation to that outer ArtifactResponse. Later, the SP validates the embedded Response against metadata selected from the embedded response issuer, not necessarily the artifact issuer.
The critical issue is that SOAPClient::validateSSL() returns normally when the TLS public key does not match the key currently being validated. SAML2\Message::validate() treats any validator call that does not throw an exception as successful. As a result, an ArtifactResponse obtained from one IdP can validate an unsigned embedded SAML Response that claims to be issued by a different IdP.
In a multi-IdP/federation deployment where a malicious or lower-trust IdP can issue an HTTP-Artifact response to an SP, this can allow the attacker to authenticate to the SP as arbitrary users from a higher-trust victim IdP.
Impact
A malicious or lower-trust IdP in the same SP/federation trust set can authenticate to the SP as users from another IdP when HTTP-Artifact is used. The attacker can choose assertion attributes, NameID, and session data in the forged unsigned assertion.
This is an authentication bypass and identity-provider impersonation issue. In realistic federations, the security boundary between IdPs matters: a compromised or low-assurance IdP should not be able to mint identities for a high-assurance IdP.
AnalysisAI
Authentication bypass and IdP impersonation in the SimpleSAMLphp saml2 library (and the saml2-legacy package) lets a malicious or lower-trust identity provider in a shared federation forge assertions for higher-trust IdPs when the HTTP-Artifact binding is used. Because the TLS-based validator applied to the SOAP ArtifactResponse returns normally instead of throwing when its public key does not match the embedded Response, an unsigned embedded SAML Response claiming a different issuer is accepted as valid, allowing an attacker to log into the SP as arbitrary users of a victim IdP. CVSS is 8.7; there is no public exploit identified at time of analysis and no CISA KEV listing.
Technical ContextAI
SimpleSAMLphp's saml2 library implements the SAML 2.0 protocol for PHP-based single sign-on, including the HTTP-Artifact binding where an SP dereferences an artifact by making a back-channel SOAP ArtifactResponse call to an IdP over TLS. In HTTPArtifact::receive(), the outer SOAP ArtifactResponse is given a TLS-based validator via SOAPClient::addSSLValidator(), and the inner embedded SAML Response delegates its signature validation to that outer ArtifactResponse rather than verifying its own XML signature. The root cause maps to CWE-295 (Improper Certificate Validation): SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() interprets any validator that does not throw an exception as a successful validation. Consequently an ArtifactResponse fetched from one IdP's TLS endpoint is treated as cryptographically vouching for an unsigned inner Response whose issuer, and therefore whose trust metadata, belongs to a different IdP.
RemediationAI
Patch available per vendor advisory: upgrade simplesamlphp/saml2 (and simplesamlphp/saml2-legacy where used) to the fixed release identified in GHSA-6929-8p9f-26jx (https://github.com/simplesamlphp/saml2/security/advisories/GHSA-6929-8p9f-26jx); the exact fixed version is not stated in the available input, so verify it in the advisory before deploying. As a compensating control until patched, disable the HTTP-Artifact binding on the SP so responses arrive only via HTTP-POST/Redirect where the inner assertion's own XML signature is validated - the trade-off is loss of Artifact/back-channel support for IdPs that only offer that binding. Where the binding must remain, restrict the federation trust set to only high-assurance IdPs and require signed SAML Responses, accepting the operational cost of stricter metadata management; do not treat TLS peer keys alone as an assertion trust signal.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today