Answer in brief
CVE-2026-49283 records a High severity (CVSS 8.7) vulnerability in SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass. The current sources do not mark it as known exploited. The current feed maps simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer), simplesamlphp/saml2 (composer) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| simplesamlphp/saml2composer | >=4.20.0,<4.20.2 | 4.20.2 |
| simplesamlphp/saml2composer | <4.19.3 | 4.19.3 |
| simplesamlphp/saml2composer | <4.20.2 | 4.20.2 |
| simplesamlphp/saml2composer | >=6.0.0,<6.2.1 | 6.2.1 |
| simplesamlphp/saml2composer | >=5.0.0,<5.0.6 | 5.0.6 |
| simplesamlphp/saml2-legacycomposer | >=4.20.0,<4.20.2 | 4.20.2 |
| simplesamlphp/saml2-legacycomposer | <4.19.3 | 4.19.3 |
| simplesamlphp/saml2-legacycomposer | <4.20.2 | 4.20.2 |
| simplesamlphp/saml2generic | < 4.19.3 || >= 4.20.0, < 4.20.2 || >= 5.0.0, < 5.0.6 || >= 6.0.0, < 6.2.1 | Not reported |
Published upstream
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 2, 2026
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1.
Quoted source text, attributed separately from HOL analysis.