CVE-2026-49289: SimpleSAMLphp SAML2 Library DoS Vulnerability

CVE-2026-49289 Overview

CVE-2026-49289 is a denial-of-service vulnerability in the SimpleSAMLphp SAML2 library, a widely used PHP library for Security Assertion Markup Language 2.0 (SAML2) functionality. Affected versions 4.19.2 and 4.20.2 permit attacker-controlled XPath transforms while processing XML signatures in crafted SAML messages. Evaluating hostile XPath expressions consumes uncontrolled processing resources, allowing a remote unauthenticated attacker to exhaust CPU on any entity relying on SimpleSAMLphp or the SAML2 library directly. The issue is classified under [CWE-400] Uncontrolled Resource Consumption. Maintainers released fixed versions 4.19.3 and 4.20.3.

Critical Impact
A remote, unauthenticated attacker can send a single crafted SAML message with a malicious XPath transform to render SAML-based authentication endpoints unresponsive.

Affected Products

SimpleSAMLphp SAML2 library version 4.19.2
SimpleSAMLphp SAML2 library version 4.20.2
Downstream applications and identity providers embedding the vulnerable SAML2 library

Discovery Timeline

2026-08-19 - CVE-2026-49289 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-49289

Vulnerability Analysis

The SAML2 library processes XML Digital Signature (XMLDSig) elements attached to inbound SAML messages. Signed references may contain Transform elements that describe how to canonicalize or filter the referenced content before hash verification. The vulnerable code accepts arbitrary transform algorithms, including XPath filter transforms, and evaluates them against the parsed DOM.

An attacker supplies an XPath expression with pathological algorithmic complexity. When the signature verification path invokes xpQuery on this expression, the underlying XPath engine performs exponential or highly recursive traversal of the document. The engine consumes CPU and memory until the request handler times out or the worker process dies.

Because SAML endpoints typically accept unauthenticated requests as part of the authentication flow, no credentials are needed. A single well-crafted SAMLResponse or SAMLRequest payload is sufficient to degrade service, and repeated requests can take a service provider or identity provider fully offline.

Root Cause

The root cause is missing validation of transform algorithms in src/SAML2/Utils.php. The pre-patch code did not enforce the transform allowlist defined by the SAML 2.0 Core specification, nor did it cap the number of ds:Transform elements permitted inside a ds:Reference. XPath filter transforms were therefore evaluated even though the SAML profile forbids them.

Attack Vector

The attack vector is network-based. An adversary submits a SAML message containing a signature whose ds:SignedInfo/ds:Reference/ds:Transforms element references an XPath transform with a resource-intensive expression. The vulnerable library evaluates the XPath against the DOM during signature validation, consuming CPU until the process is terminated. No user interaction and no prior authentication are required.

php

         $signatureElement = $signatureElement[0];
         $objXMLSecDSig->sigNode = $signatureElement;
 
+        /** Locate the XMLDSig Transform elements */
+        /** @var \DOMElement[] $transformElement */
+        $transformElement = self::xpQuery($signatureElement, './ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform');
+        if (count($transformElement) > 2) {
+            throw new Exception('XMLSec: more than two transform-operations in ds:Reference.');
+        }
+
+        if (count($transformElement) > 0) {
+            /** Check the algorithms in the Transform-elements */
+            /** @var \DOMElement[] $algorithms */
+            $algorithms = self::xpQuery(
+                $signatureElement,
+                sprintf(
+                    "./ds:SignedInfo/ds:Reference/ds:Transforms/ds:Transform["
+                    . "not(@Algorithm='%s') and not(@Algorithm='%s') and not(@Algorithm='%s')]",
+                    XMLSecurityDSig::EXC_C14N,
+                    XMLSecurityDSig::EXC_C14N_COMMENTS,
+                    'http://www.w3.org/2000/09/xmldsig#enveloped-signature',
+                ),
+            );
+
+            if (count($algorithms) > 0) {
+                throw new Exception(
+                    'XMLSec: Signatures in SAML messages SHOULD NOT contain transforms other than the '
+                    . 'enveloped signature transform or the exclusive canonicalization transforms.',
+                );
+            }

Source: GitHub commit 0043033 — the fix caps transform elements at two, restricts algorithms to exclusive canonicalization and enveloped-signature, and rejects XPath transforms outright.

Detection Methods for CVE-2026-49289

Indicators of Compromise

SAML messages containing ds:Transform elements with Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116" or the XPath filter 2.0 URI http://www.w3.org/2002/06/xmldsig-filter2.
Inbound SAMLRequest or SAMLResponse payloads with more than two ds:Transform children under a single ds:Reference.
Sudden CPU saturation on PHP-FPM or Apache worker processes tied to SAML endpoints such as /saml/SSO, /saml/ACS, or /simplesaml/module.php/saml/sp/*.

Detection Strategies

Inspect proxied HTTP request bodies destined for SAML endpoints and flag base64-decoded XML containing XPath transform algorithm URIs.
Correlate PHP process CPU-time anomalies with concurrent SAML endpoint requests to identify resource-exhaustion attempts.
Enable verbose logging in the SAML2 library and alert on XMLSec exceptions raised by the patched validation code, which indicate probing attempts once the fix is deployed.

Monitoring Recommendations

Track request-duration percentiles (p95/p99) on SAML assertion consumer service endpoints and alert on outliers.
Monitor for repeated requests from the same source IP delivering large or structurally unusual XML signatures.
Ship web server, PHP-FPM, and SimpleSAMLphp logs to a centralized data lake and build dashboards keyed on SAML endpoint latency and error rates.

How to Mitigate CVE-2026-49289

Immediate Actions Required

Upgrade the SimpleSAMLphp SAML2 library to 4.19.3 or 4.20.3, depending on your current branch.
Audit dependent applications and Composer lockfiles to confirm no transitive dependency pins a vulnerable version.
Restart PHP-FPM or the relevant application server after upgrade to ensure the patched code is loaded.

Patch Information

The upstream fix is tracked in GitHub Security Advisory GHSA-5cjr-mxj5-wmrx and implemented across commit 0043033 and the backport in commit 6695eb9. The mitigation caps the number of transforms at two, permits only algorithms identified by the SAML 2.0 Core specification, and explicitly rejects XPath transforms.

Workarounds

Deploy a web application firewall rule that inspects decoded SAML payloads and blocks messages containing XPath transform algorithm URIs.
Enforce request timeouts and per-worker CPU limits on PHP processes serving SAML endpoints to bound resource exhaustion.
Rate-limit unauthenticated SAML endpoints per source IP to reduce the impact of repeated abusive requests.

bash

# Composer upgrade example
composer require simplesamlphp/saml2:^4.20.3 --update-with-dependencies
# Or for the 4.19 branch
composer require simplesamlphp/saml2:^4.19.3 --update-with-dependencies
composer show simplesamlphp/saml2
sudo systemctl restart php-fpm