Critical SAML Vulnerabilities Found in SimpleSAMLphp
Multiple high-severity flaws in SimpleSAMLphp expose systems to impersonation and data leaks. Organizations using older Ubuntu LTS versions should act immediately.
TL;DR
- SimpleSAMLphp contains three critical vulnerabilities affecting signature validation and XML parsing.
- Attackers can exploit these flaws to impersonate users or bypass authentication entirely.
- Sensitive information disclosure is possible through improper handling of XML external entities.
- Only Ubuntu 16.04 LTS and 18.04 LTS are impacted by CVE-2019-3465.
- All deployments should update immediately; CVE-2025-27773 affects all versions prior to latest patch.
Organizations relying on SimpleSAMLphp for identity federation may be exposed to serious security risks due to multiple newly disclosed vulnerabilities. These flaws affect core functions such as cryptographic signature validation and XML document parsing, potentially allowing attackers to impersonate legitimate users or extract sensitive data.
The most severe issues impact older Ubuntu Long Term Support releases, though some vulnerabilities extend beyond specific distributions. Given the widespread adoption of SimpleSAMLphp across enterprise environments, development and security teams managing authentication infrastructure must prioritize patching affected systems.
Authentication Bypass and Impersonation Risks
- CVE-2019-3465 allows authenticated attackers to forge XML message signatures, enabling user impersonation and privilege escalation.
- CVE-2025-27773 impacts SAML message verification when using HTTP-Redirect binding, which could allow remote attackers to fully bypass authentication controls.
- Both vulnerabilities require different levels of access but result in similar high-impact compromises if exploited successfully.
- These issues primarily affect legacy Ubuntu LTS versions including 16.04 and 18.04, where patches are now available.
Data Exposure Through XML Processing Flaws
- CVE-2024-52596 involves insecure handling of external XML entities during document parsing, leading to potential information disclosure.
- This vulnerability does not affect Ubuntu 24.04 LTS, indicating improved default protections in newer distributions.
- Remote attackers can leverage this flaw without authentication to extract internal file contents or conduct server-side request forgery attacks.
- Applications processing unsolicited SAML responses or metadata from untrusted sources are particularly at risk.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.