Description

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in specially crafted SAML messages. XPath evaluation can consume uncontrolled processing resources, allowing a remote unauthenticated attacker to deny service to any entity relying on SimpleSAMLphp or directly on the SAML2 library. The mitigation limits the number of transforms, permits only transform algorithms identified by the SAML 2.0 Core specification, and specifically rejects XPath transforms. This issue is fixed in versions 4.19.3 and 4.20.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T15:17:07.180Z",
  "pubdate": "2026-08-19T15:17:07.180Z",
  "executiveSummary": "A Denial of Service vulnerability exists in the SimpleSAMLphp SAML2 library due to improper handling of XML signatures. Specifically, the library permits attacker-controlled XPath transforms during the processing of specially crafted SAML messages. Unconstrained XPath evaluation leads to the excessive consumption of processing resources, causing application hangs or crashes. This vulnerability impacts any entity relying on the SimpleSAMLphp SAML2 library for authentication and assertion processing.\nThe flaw allows a remote, unauthenticated attacker with network access to the target service to disrupt availability completely. Exploitation requires sending a maliciously crafted SAML message containing malicious XPath transform parameters designed to exhaust CPU and memory resources during signature validation. The risk implication is critical operational downtime for dependent identity providers or service providers. The vulnerability is resolved by restricting transform counts, enforcing strict adherence to allowed SAML 2.0 Core specification transform algorithms, and explicitly rejecting XPath transforms.",
  "technicalDetails": "The vulnerability resides within the XML signature processing component of the SimpleSAMLphp SAML2 library, specifically in how it parses and evaluates transforms applied to XML signatures. The root cause is the lack of restriction on attacker-controlled XPath transforms within SAML messages. When processing incoming XML signatures, the library evaluates XPath expressions supplied by the sender without enforcing resource constraints or validating the necessity of such transforms.\nExploitation occurs when a remote, unauthenticated attacker crafts a malicious SAML message containing deeply nested, computationally expensive, or infinite-loop-inducing XPath expressions inside the signature transform nodes. Upon receipt, the vulnerable component parses the SAML message and hands the XML structure to the signature validation engine, which executes the attacker-controlled XPath evaluation. Because XPath processing is inherently resource-intensive, the evaluation of the malicious payload consumes disproportionate CPU and memory resources on the host running the SimpleSAMLphp SAML2 library.\nThe attack flow proceeds as follows: First, the remote attacker intercepts or generates a SAML authentication response targeted at the vulnerable service. Second, the attacker injects an XML signature transform containing a malicious XPath expression into the assertion's signature block. Third, the attacker transmits the crafted SAML message over the network to the service provider or identity provider endpoint utilizing the affected library. Fourth, the library attempts to validate the XML signature, executing the embedded XPath transform. Fifth, the excessive resource consumption triggers a Denial of Service condition, rendering the application unresponsive to legitimate users.\nAffected versions of the library include 4.19.2 and 4.20.2. The vulnerability requires no authentication or special privileges, as it can be triggered externally via standard SAML message submission channels such as HTTP-POST or HTTP-Redirect bindings. Post-exploitation impact is limited to service unavailability, as arbitrary code execution is not facilitated by this specific resource exhaustion vector."
}