Signature Confusion Vulnerability in SimpleSAMLphp SAML2 Library

CVE-2025-27773

What is CVE-2025-27773?

The SimpleSAMLphp SAML2 library, utilized for SAML2 functionality, is exposed to a signature confusion vulnerability within its HTTP-Redirect binding. An attacker can exploit this vulnerability by sending a signed SAMLResponse, tricking the application into accepting an unsigned message. This flaw exists in versions prior to 4.17.0 and 5.0.0-alpha.20, which include patches to mitigate this security risk.

References