SAML Signature Validation Flaw in LightSAML Affects Security Protocol Implementation

CVE-2026-63182

What is CVE-2026-63182?

LightSAML contains a vulnerability related to the SAML 2.0 data model that affects signature validation. The flaw arises from discrepancies in how LightSAML and xmlseclibs interpret inbound SAML signatures. Specifically, the deserialization process may yield a forged assertion that can bypass authentication checks, leading to potential privilege escalation. An attacker can manipulate the SAML response by leveraging captured signed assertions to present unauthorized claims. The issue was addressed in versions 4.7.1 and 5.0.1.

References