Listen to this Post
Introduction:
SimpleSAMLphp, a widely deployed PHP library implementing SAML 2.0 federation, has recently become a focal point for critical security research. At the heart of these discoveries are intricate cryptographic validation flaws—specifically CVE-2026-49283 and CVE-2026-49284—that allow malicious or lower-trust Identity Providers (IdPs) to impersonate users from higher-trust IdPs in multi-tenant federation environments. These vulnerabilities, alongside historical XXE issues like CVE-2024-52806, highlight the persistent challenges in securing SAML-based authentication flows. This article breaks down the technical mechanics of these bugs, provides actionable detection and mitigation strategies, and explores how security researchers can scale their discovery efforts across thousands of applications.
Learning Objectives & Secrets:
- Objective 1: Understand the root cause of CVE-2026-49283—how TLS validator confusion in the HTTP-Artifact binding enables cross-IdP authentication bypass.
- Objective 2 (Secret Tip): Learn to detect CVE-2026-49284 by crafting SAML responses with unsigned `InResponseTo` attributes and missing `SubjectConfirmationData/InResponseTo` to exploit IdP mismatch warnings.
- Objective 3 (Secret Tip): Master large-scale vulnerability discovery using Shodan, Censys, and custom HTTP fingerprints to identify exposed SimpleSAMLphp instances and rapidly validate patch levels.
You Should Know:
1. CVE-2026-49283: HTTP-Artifact TLS Validator Confusion
This critical vulnerability resides in the `HTTPArtifact::receive()` flow. When an SP uses HTTP-Artifact binding, it receives an artifact from the IdP and exchanges it for a full SAML response via SOAP. The library attaches a TLS-based validator to the outer SOAP `ArtifactResponse` via SOAPClient::addSSLValidator(). However, the embedded SAML `Response` inside the SOAP envelope receives a separate validator that delegates its checks back to the outer message’s context. The critical flaw is twofold: `SOAPClient::validateSSL()` returns normally even when the TLS public key does not match the key being validated, and `SAML2\Message::validate()` treats any validator call that does not throw an exception as successful. Consequently, an `ArtifactResponse` obtained from one IdP can validate an unsigned embedded SAML `Response` that claims to be issued by a different, higher-trust IdP.
Step‑by‑step guide to test for CVE-2026-49283:
- Identify the target SP that trusts multiple IdPs and supports HTTP-Artifact binding.
- Set up a malicious or low-trust IdP within the same federation.
- Craft an `ArtifactResponse` from the malicious IdP containing an unsigned SAML `Response` that asserts the victim IdP as the issuer.
- Submit the crafted artifact to the SP’s artifact resolution endpoint.
- Observe authentication: If the SP accepts the response and authenticates the user with attacker-chosen attributes, the SP is vulnerable.
Linux Command to check SimpleSAMLphp version:
Check version from composer.lock grep -A 2 '"name":"simplesamlphp/saml2"' composer.lock | grep version Check installed version via PHP php -r "require 'vendor/autoload.php'; echo SimpleSAML\Utils\Config::getVersion();"
Mitigation: Upgrade to patched versions: 4.19.3, 4.20.2, 5.0.6, or 6.2.1.
2. CVE-2026-49284: IdP Mismatch Bypass in SP-Initiated Logins
This vulnerability affects SimpleSAMLphp versions up to 2.4.6 and between 2.5.0 and 2.5.1. The SP fails to enforce the expected IdP during an SP-initiated login. If a saved SP state expects a response from IdP A, but the ACS receives a valid SAML response from a different trusted IdP (IdP B), SimpleSAMLphp logs a warning but proceeds to process the response. When combined with unsigned `samlp:Response/@InResponseTo` elements and signed assertions lacking SubjectConfirmationData/InResponseTo, an attacker can bind a lower-trust IdP’s response to SP state created for a higher-trust IdP.
Step‑by‑step guide to test for CVE-2026-49284:
- Initiate an SP‑initiated login to the target SP, which expects authentication from a high‑trust IdP (IdP A).
- Intercept the SAML exchange and redirect the user or craft a response from a trusted but lower‑assurance IdP (IdP B).
- Generate a SAML response from IdP B containing a valid signed assertion but deliberately omit the `InResponseTo` attribute within
SubjectConfirmationData. - Include an unsigned `samlp:Response/@InResponseTo` attribute matching the expected value from the SP-initiated request.
- Submit the crafted SAML response to the SP’s ACS endpoint. If the SP processes the response despite the IdP mismatch and authenticates the user as if they logged in via IdP A, the SP is vulnerable.
Python snippet to craft a malicious SAML response (conceptual):
from saml2 import saml, samlp from saml2.sigver import SignatureError Craft unsigned Response with InResponseTo response = samlp.Response() response.in_response_to = "original_request_id" Create assertion from IdP B with missing SubjectConfirmationData/InResponseTo assertion = saml.Assertion() ... populate assertion with attacker-controlled attributes Submit to ACS endpoint
Mitigation: Upgrade to versions 2.4.7 or 2.5.2.
3. CVE-2024-52806: Pre-Auth XXE File Read
This older but still prevalent vulnerability allows an unauthenticated attacker to induce an XXE (XML External Entity) attack when parsing untrusted SAML responses. The library’s `DOMDocumentFactory` included `LIBXML_DTDLOAD` and `LIBXML_DTDATTR` options, enabling an attacker to read local files or make network connections via PHP filters.
Step‑by‑step guide to test for CVE-2024-52806:
- Craft a SAML response containing an external entity that references a local file, e.g.,
php://filter/convert.base64-encode/resource=/etc/passwd. - Submit the crafted SAML response to the SP’s ACS endpoint.
- Observe the response: If the server returns the contents of the referenced file in the response or error message, the XXE is exploitable.
Linux Command to check for XXE mitigation:
Check if LIBXML_DTDLOAD is disabled in php.ini php -i | grep libxml Expected: libxml2 Version => 2.9.0+ with LIBXML_NOENT, LIBXML_NONET enabled
Mitigation: Remove `LIBXML_DTDLOAD | LIBXML_DTDATTR` options from `DOMDocumentFactory` and upgrade to patched versions. A public PoC is available for this vulnerability.
4. Large-Scale Vulnerability Discovery: Fingerprinting SimpleSAMLphp at Scale
Security researchers often need to identify vulnerable instances across thousands of applications. Animesh Acharya’s talk highlights the importance of scaling discovery efforts. Here are practical techniques:
Shodan Dork:
http.title:"SimpleSAMLphp" || http.component:"SimpleSAMLphp"
Censys Search:
services.http.response.body: "SimpleSAMLphp"
Custom HTTP Header Fingerprint:
curl -I https://target.com/saml/module.php/core/login Look for headers like X-Powered-By: SimpleSAMLphp
Automated Version Check using Nuclei:
id: simplesamlphp-version
info:
name: SimpleSAMLphp Version Detection
severity: info
requests:
- method: GET
path:
- "{{BaseURL}}/simplesaml/module.php/core/login"
matchers:
- type: word
words:
- "SimpleSAMLphp"
part: body
extractors:
- type: regex
part: body
regex:
- "SimpleSAMLphp ([0-9.]+)"
Bulk Shodan Query with Python:
import shodan
api = shodan.Shodan('YOUR_API_KEY')
results = api.search('http.title:"SimpleSAMLphp"')
for result in results['matches']:
print(f"{result['ip_str']}:{result['port']} - {result['http']['title']}")
5. Mitigation Strategies and Hardening
Beyond patching, organizations should implement defense-in-depth:
- Disable HTTP-Artifact binding if not required: Set `’artifact’ => false` in the SP configuration.
- Enforce strict IdP validation in custom SAML processing code.
- Disable external entity loading globally in PHP:
libxml_disable_entity_loader(true). - Monitor SAML logs for IdP mismatch warnings:
grep "IdP mismatch" /var/log/simplesamlphp.log. - Implement Web Application Firewall (WAF) rules to block suspicious SAML requests containing external entities or unexpected IdP assertions.
What Undercode Say:
- Key Takeaway 1: The most insidious SAML vulnerabilities often stem not from cryptographic weaknesses in the protocol itself, but from implementation flaws in how libraries validate the binding between artifacts, responses, and identity providers. The TLS validator confusion in CVE-2026-49283 is a prime example of how delegation of validation logic can create a false sense of security.
-
Key Takeaway 2: Large-scale vulnerability discovery is as much about methodology as it is about technical skill. Combining public internet scanning with automated version detection and custom fingerprinting allows researchers to rapidly identify and report vulnerable instances, turning CVEs without public PoCs into multiple bounties—exactly as demonstrated in Animesh Acharya’s presentation.
Prediction:
-
+1 The disclosure of these vulnerabilities will drive significant adoption of automated SAML security scanning tools and dependency checking in CI/CD pipelines, improving overall federation security posture.
-
-1 However, the complexity of SAML deployments and the slow upgrade cycles in enterprise environments mean that CVE-2026-49283 and CVE-2026-49284 will likely remain exploitable in the wild for months, if not years, leading to a wave of identity-based attacks targeting federated applications.
▶️ Related Video (84% Match):
https://www.youtube.com/watch?v=2VB4Zd5C8N8
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/erqRMzyb – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
