CVE-2026-32600: Simplesamlphp Xml-security XXE Vulnerability

CVE-2026-32600 Overview

CVE-2026-32600 is a cryptographic vulnerability affecting the SimpleSAMLphp xml-security library, which implements XML signatures and encryption. The vulnerability stems from improper validation of authentication tag lengths when using AES-GCM encryption modes (aes-128-gcm, aes-192-gcm, or aes-256-gcm). This weakness allows attackers to brute-force authentication tags, recover the GHASH key, and ultimately decrypt encrypted XML nodes without possessing the encryption key.

Critical Impact

Attackers can decrypt sensitive XML data and forge arbitrary ciphertexts without knowledge of the encryption key, compromising the confidentiality and integrity of SAML assertions and other encrypted XML content.

Affected Products

• SimpleSAMLphp xml-security versions prior to 2.3.1
• SimpleSAMLphp xml-security versions prior to 1.13.9

Discovery Timeline

• 2026-03-16 - CVE-2026-32600 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-32600

Vulnerability Analysis

The xml-security library fails to properly validate the length of authentication tags when processing XML nodes encrypted with AES-GCM (Galois/Counter Mode). GCM is an authenticated encryption mode that produces an authentication tag to verify ciphertext integrity. According to NIST specifications, the authentication tag should be a fixed length (typically 128 bits) to provide adequate security guarantees.

When the library accepts authentication tags of arbitrary or truncated lengths, it dramatically reduces the computational effort required to forge valid tags. An attacker exploiting this flaw can systematically brute-force short authentication tags, and once successful, can recover the GHASH polynomial hash key. With the GHASH key in hand, the attacker can decrypt encrypted XML nodes and craft arbitrary forged ciphertexts that pass authentication checks.

This vulnerability is particularly dangerous in SAML environments where xml-security is commonly deployed, as it could allow attackers to decrypt and forge SAML assertions, potentially bypassing authentication entirely.

Root Cause

The root cause is CWE-354: Improper Validation of Integrity Check Value. The library's OpenSSL backend did not enforce proper validation of GCM authentication tag lengths, accepting tags shorter than the cryptographically required minimum. This implementation oversight violates the security assumptions of the GCM mode, which relies on full-length authentication tags to resist forgery attacks.

Attack Vector

The vulnerability is exploitable over the network without authentication. An attacker can intercept or obtain encrypted XML content and perform the following attack sequence:

1. Capture encrypted XML nodes using AES-GCM encryption
2. Submit modified ciphertexts with truncated authentication tags
3. Brute-force the shortened tag space to find valid combinations
4. Recover the GHASH key from successful forgeries
5. Decrypt the original encrypted content or forge new ciphertexts

The patch adds proper validation by introducing a RuntimeException to enforce authentication tag length requirements in the OpenSSL backend:

 use SimpleSAML\XMLSecurity\Constants as C;
 use SimpleSAML\XMLSecurity\Exception\InvalidArgumentException;
 use SimpleSAML\XMLSecurity\Exception\OpenSSLException;
+use SimpleSAML\XMLSecurity\Exception\RuntimeException;
 use SimpleSAML\XMLSecurity\Key\AsymmetricKey;
 use SimpleSAML\XMLSecurity\Key\KeyInterface;
 use SimpleSAML\XMLSecurity\Key\PrivateKey;

Source: GitHub Security Commit

Detection Methods for CVE-2026-32600

Indicators of Compromise

• Unusual patterns of failed decryption attempts followed by successful ones against SAML endpoints
• Encrypted XML payloads with abnormally short authentication tags (less than 128 bits)
• Multiple rapid requests containing modified ciphertext to authentication endpoints
• Log entries showing GCM decryption operations with non-standard tag lengths

Detection Strategies

• Audit installed versions of simplesamlphp/xml-security using Composer to identify vulnerable deployments (composer show simplesamlphp/xml-security)
• Implement application-layer logging for all XML encryption and decryption operations
• Monitor SAML IdP and SP endpoints for unusual request patterns or authentication anomalies
• Deploy web application firewalls with rules to detect malformed XML encryption payloads

Monitoring Recommendations

• Enable verbose logging on SAML authentication flows to capture encryption-related errors
• Set up alerts for repeated authentication failures from single sources targeting SAML endpoints
• Monitor dependency management systems for vulnerable package versions across your infrastructure
• Track network traffic for unusually high volumes of encrypted XML submissions

How to Mitigate CVE-2026-32600

Immediate Actions Required

• Upgrade SimpleSAMLphp xml-security to version 2.3.1 or later for the 2.x branch
• Upgrade SimpleSAMLphp xml-security to version 1.13.9 or later for the 1.x branch
• Review SAML-based authentication systems for potential compromise if running vulnerable versions
• Rotate encryption keys used with the xml-security library as a precautionary measure

Patch Information

The vulnerability is fixed in versions 2.3.1 and 1.13.9 of the SimpleSAMLphp xml-security library. Security patches are available via the official GitHub repository. The fix introduces proper validation of GCM authentication tag lengths by adding a RuntimeException to reject improperly formatted encrypted content.

For detailed patch information, see the GitHub Security Advisory.

Workarounds

• Consider temporarily disabling AES-GCM encryption modes and using alternative algorithms like AES-CBC with HMAC until patches can be applied
• Implement additional integrity checks at the application layer for encrypted XML content
• Restrict network access to SAML endpoints to trusted sources only while awaiting patch deployment

# Update xml-security via Composer
composer require simplesamlphp/xml-security:^2.3.1

# Or for the 1.x branch
composer require simplesamlphp/xml-security:^1.13.9

# Verify installed version
composer show simplesamlphp/xml-security