CVE-2026-49283: SimpleSAMLphp Auth Bypass Vulnerability

CVE-2026-49283 Overview

CVE-2026-49283 is a certificate validation flaw [CWE-295] in the SimpleSAMLphp SAML2 PHP library. The HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider (IdP). The defect stems from TLS validator confusion between the outer SOAP ArtifactResponse and the embedded Response message. In multi-IdP federations, a lower-trust or malicious IdP can craft an ArtifactResponse that impersonates a higher-trust victim IdP and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. Versions prior to 4.19.3, 4.20.2, 5.0.6, and 6.2.1 are affected.

Critical Impact
A malicious federation member can impersonate any user of a trusted IdP, bypassing SAML signature validation and gaining full authentication as arbitrary identities.

Affected Products

SimpleSAMLphp SAML2 library versions prior to 4.19.3
SimpleSAMLphp SAML2 library versions prior to 4.20.2 and 5.0.6
SimpleSAMLphp SAML2 library versions prior to 6.2.1

Discovery Timeline

2026-08-19 - CVE-2026-49283 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49283

Vulnerability Analysis

The flaw resides in how the SAML2 library validates the signature of an embedded SAML Response returned inside a SOAP ArtifactResponse envelope. SOAPClient::addSSLValidator() attaches a Transport Layer Security (TLS)-based validator to the outer SOAP ArtifactResponse. The embedded Response receives a validator that delegates to the outer message. The library then checks that validator against metadata selected from the embedded response issuer rather than the artifact issuer.

Two compounding defects turn the confusion into a bypass. First, SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated. Second, SAML2\Message::validate() treats any validator call that does not throw an exception as successful. The combination means an unsigned embedded Response passes validation because no exception is raised.

Root Cause

The root cause is improper certificate validation [CWE-295] combined with validator scope confusion. The trust anchor used to authorize the embedded assertion is derived from the attacker-controlled Issuer element of that embedded message rather than the artifact-resolution IdP that terminated the TLS connection. This decoupling of TLS peer identity from the SAML issuer identity breaks the federation trust model.

Attack Vector

An attacker who controls or compromises any lower-trust IdP participating in the same federation initiates an HTTP-Artifact binding flow. The attacker returns a SOAP ArtifactResponse that embeds an unsigned SAML Response whose Issuer element names a higher-trust victim IdP. The service provider (SP) selects the victim IdP metadata, invokes the flawed validator chain, and accepts the response as authentic. The attacker chooses arbitrary NameID, attribute statements, and session data.

php

// Security patch in src/SOAPClient.php
// Replaces direct BuiltinSoapClient instantiation with testable wrappers
// so that SSL key validation can be properly enforced.

        $action = 'http://www.oasis-open.org/committees/security';
        /* Perform SOAP Request over HTTP */
-        $x = new BuiltinSoapClient(null, $options);
-        $soapresponsexml = $x->__doRequest($request, $destination, $action, SOAP_1_1, false);
+        $x = $this->createSoapClient($options);
+        $soapresponsexml = $this->doSoapRequest($x, $request, $destination, $action);
         if (empty($soapresponsexml)) {
             throw new Exception('Empty SOAP response, check peer certificate.');
         }

Source: GitHub Commit a2c1ac5

Detection Methods for CVE-2026-49283

Indicators of Compromise

SAML ArtifactResponse messages where the outer SOAP TLS peer certificate does not match the metadata of the Issuer in the embedded Response.
Successful authentications where the embedded SAML Response lacks a ds:Signature element yet completed the assertion consumer flow.
Session establishment for high-privilege accounts originating from IdP endpoints not previously associated with those users.

Detection Strategies

Inspect SP-side SAML logs for ArtifactResponse payloads and correlate the SOAP endpoint URL with the embedded Issuer metadata entity ID.
Alert on any embedded Response that is not signed when the deployment policy requires signed assertions across the federation.
Compare authentication events against expected IdP-to-user mappings to detect impersonation of users assigned to a different IdP.

Monitoring Recommendations

Enable verbose SAML debug logging on service providers to capture full artifact resolution transcripts during the remediation window.
Monitor federation metadata pipelines and outbound SOAP artifact-resolution calls for unexpected destinations.
Track authentication anomalies such as new NameID formats or attribute sets not previously seen for a given user.

How to Mitigate CVE-2026-49283

Immediate Actions Required

Upgrade the SimpleSAMLphp SAML2 library to 4.19.3, 4.20.2, 5.0.6, or 6.2.1 depending on the deployed major branch.
Audit federation trust configuration and remove any IdP that is not fully trusted while the patch is being rolled out.
Force re-authentication and invalidate active sessions established via the HTTP-Artifact binding.

Patch Information

The fix is delivered across four commits in the upstream repository. The primary changes rework SOAPClient to correctly bind the TLS validator to the artifact-resolution IdP and enforce a signature check on the embedded Response. See GitHub Security Advisory GHSA-6929-8p9f-26jx, along with the SOAPClient SSL validation fix and the backport commit.

Workarounds

Disable the HTTP-Artifact binding on service providers and require the HTTP-POST or HTTP-Redirect bindings until the patch is applied.
Restrict federation membership to a single trusted IdP where feasible, eliminating the multi-IdP precondition for exploitation.
Require signed SAML responses at the SP configuration layer so unsigned embedded responses are rejected before validator confusion applies.

bash

# Update SimpleSAMLphp SAML2 library via Composer
composer require simplesamlphp/saml2:^6.2.1

# Verify installed version
composer show simplesamlphp/saml2 | grep versions

# Optional: disable HTTP-Artifact binding in authsources.php
# 'saml:SP' => [
#     'AssertionConsumerService' => [
#         ['Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'],
#     ],
# ],