Lightsaml
Monthly
XML signature wrapping in LightSAML (4.x before 4.7.1 and 5.x before 5.0.1) lets an attacker who already holds one genuinely IdP-signed SAML assertion redirect signature validation to a buried copy of that genuine assertion while LightSAML consumes attacker-authored claims from a forged direct-child assertion, yielding authentication bypass and privilege escalation up to full impersonation of arbitrary NameID, Conditions and role attributes. The flaw requires only a low-privilege position (PR:L) - a captured earlier login response or the attacker's own legitimate assertion - and works even when the Service Provider enforces requireSignature=true, since the copied genuine ds:Signature still validates. Fixed in 4.7.1 and 5.0.1; the vendor advisory and a working PoC script are public, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided at time of analysis.
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
XML signature wrapping in LightSAML (4.x before 4.7.1 and 5.x before 5.0.1) lets an attacker who already holds one genuinely IdP-signed SAML assertion redirect signature validation to a buried copy of that genuine assertion while LightSAML consumes attacker-authored claims from a forged direct-child assertion, yielding authentication bypass and privilege escalation up to full impersonation of arbitrary NameID, Conditions and role attributes. The flaw requires only a low-privilege position (PR:L) - a captured earlier login response or the attacker's own legitimate assertion - and works even when the Service Provider enforces requireSignature=true, since the copied genuine ds:Signature still validates. Fixed in 4.7.1 and 5.0.1; the vendor advisory and a working PoC script are public, and no confirmed active exploitation (CISA KEV) or EPSS signal was provided at time of analysis.
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.