CVE-2026-49284: SimpleSAMLphp Information Disclosure Flaw

CVE-2026-49284 Overview

CVE-2026-49284 is an information disclosure and authentication binding vulnerability affecting SimpleSAMLphp, an open-source SAML implementation used by identity federation deployments. The flaw exists in the SAML Service Provider (SP) Assertion Consumer Service (ACS) path. It fails to enforce that the Identity Provider (IdP) selected for an SP-initiated login matches the IdP that issues the SAML response. When an unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, an attacker can bind a response from one trusted IdP to SP state created for another IdP. This bypasses IdP-routing controls, even when enable_unsolicited is set to false.

Critical Impact
Attackers with access to a trusted federated IdP can hijack SP-initiated login flows intended for a different IdP, breaking multi-IdP trust boundaries and enabling account impersonation across federated tenants.

Affected Products

SimpleSAMLphp versions prior to 2.4.7 (2.4.x branch)
SimpleSAMLphp versions prior to 2.5.2 (2.5.x branch)
Legacy SimpleSAMLphp deployments before 1.18.6 with related information disclosure exposure

Discovery Timeline

2026-07-17 - CVE-2026-49284 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-49284

Vulnerability Analysis

The vulnerability sits at the intersection of SAML message validation and session state binding. SimpleSAMLphp's SP component initiates authentication by generating an AuthnRequest and recording state that includes the intended IdP entity ID. When the browser returns to the ACS endpoint with a SAML Response, the SP must validate that the response originated from the same IdP recorded in the state. The affected code path skips this enforcement under a specific message shape. This weakness maps to [CWE-345] Insufficient Verification of Data Authenticity.

Root Cause

The root cause is missing cross-validation between the request-time IdP selection and the response-time issuer. When the outer Response element is unsigned and its InResponseTo is unsigned, the SP relies on the inner signed assertion for trust. If that assertion omits SubjectConfirmationData/InResponseTo, no field ties the assertion back to the specific AuthnRequest ID. The ACS handler accepts the assertion as long as the issuing IdP is trusted, without confirming it matches the IdP the user was routed to.

Attack Vector

An attacker who controls or compromises one trusted IdP in the federation crafts a signed assertion for a target user. The attacker then delivers this assertion to the victim SP's ACS endpoint while the victim holds SP state for a login started against a different IdP. The SP consumes the mismatched assertion, authenticating the session under attacker-controlled context. The attack requires low privileges on a trusted IdP and no user interaction beyond a normal login flow.

Refer to the GitHub Security Advisory GHSA-q8r6-xj3f-wrrm for the maintainers' technical description.

Detection Methods for CVE-2026-49284

Indicators of Compromise

SAML Response messages at the ACS endpoint where the Issuer entity ID does not match the IdP recorded in the SP's request state.
Signed assertions arriving at ACS without a SubjectConfirmationData/InResponseTo attribute paired with an unsigned outer Response.
Successful authentications immediately following an AuthnRequest directed to a different IdP than the one that issued the assertion.

Detection Strategies

Parse SimpleSAMLphp application logs and correlate saml:sp:AuthnRequest events with subsequent saml:sp:Response events, alerting when issuer entity IDs diverge.
Enable debug-level SAML message logging temporarily to capture full XML and inspect signature scope and InResponseTo presence.
Monitor federation metadata proxies and reverse proxies for ACS POSTs containing signed assertions but no confirmation InResponseTo.

Monitoring Recommendations

Ingest SimpleSAMLphp and webserver logs into a centralized analytics platform and build alerts on IdP entity ID mismatch between request and response.
Track version strings across SimpleSAMLphp deployments and alert on any host still running versions below 2.4.7 or 2.5.2.
Baseline expected Issuer values per SP and flag any first-seen IdP issuing assertions to a given SP.

How to Mitigate CVE-2026-49284

Immediate Actions Required

Upgrade SimpleSAMLphp to version 2.4.7 or 2.5.2, matching the branch already deployed.
Audit federation trust stores and remove any IdP entries that are no longer required for business operations.
Review recent authentication logs for issuer mismatches and invalidate suspicious sessions.

Patch Information

The SimpleSAMLphp maintainers released fixes in SimpleSAMLphp v2.4.7 and SimpleSAMLphp v2.5.2. Both releases enforce that the IdP recorded in SP-initiated login state matches the issuer of the returned assertion and require InResponseTo binding when applicable. Administrators using package repositories should update to the packaged builds that correspond to these upstream tags.

Workarounds

Restrict the SP's federation metadata to a single trusted IdP where operationally feasible, eliminating cross-IdP confusion.
Enforce assertion-level SubjectConfirmationData/InResponseTo validation via a custom authentication processing filter until the patch is applied.
Require signed SAML Response elements from all IdPs, not only signed assertions, in SP metadata configuration.

bash

# Upgrade SimpleSAMLphp using Composer to a fixed release
composer require simplesamlphp/simplesamlphp:^2.5.2

# Or, for the 2.4.x branch
composer require simplesamlphp/simplesamlphp:^2.4.7

# Verify the installed version
php -r "require 'vendor/autoload.php'; echo SimpleSAML\Configuration::VERSION;"