{"id":"CVE-2026-49284","published":"2026-07-17T19:17:23Z","modified":"2026-07-20T19:22:12Z","title":"SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a…","vendor":"simplesamlphp","product":"simplesamlphp","tier":"tail","description":{"text":"SimpleSAMLphp versions before 1.18.6 contain an information disclosure vulnerability. Prior to 2.4.7 and 2.5.2, SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo, allowing a response issued by one trusted IdP to be bound to SP state created for another IdP and bypass flows that route users to a specific IdP, including deployments that set enable_unsolicited to false. This issue is fixed in versions 2.4.7 and 2.5.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.1,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00222,"percentile":0.12789,"provenance":"source"},"cwes":[{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"}],"references":[{"url":"https://github.com/simplesamlphp/simplesamlphp/security/advisories/GHSA-q8r6-xj3f-wrrm","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.4.7","tags":["x_refsource_MISC"]},{"url":"https://github.com/simplesamlphp/simplesamlphp/releases/tag/v2.5.2","tags":["x_refsource_MISC"]}],"priority":{"score":7.5,"factors":[{"name":"EPSS percentile","points":2.56},{"name":"CVSS severity","points":4.97}]},"vendorSlug":"simplesamlphp","affectedVersions":[{"vendor":"simplesamlphp","product":"simplesamlphp","versions":["< 2.4.7",">= 2.5.0-rc1, < 2.5.2"]}],"affected":[{"ecosystem":"Packagist","package":"simplesamlphp/simplesamlphp","vulnerableRanges":[">=2.5.0, <2.5.2","<2.4.7"],"patched":["2.5.2","2.4.7"],"from":["GHSA-q8r6-xj3f-wrrm"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-45284","exploited":false,"provenance":"source"}}