CVE-2025-27773

EUVD-2025-7804
The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion attack in the HTTPRedirect binding. An attacker with any signed SAMLResponse via the HTTP-Redirect binding can cause the application to accept an unsigned message. Versions 4.17.0 and 5.0.0-alpha.20 contain a fix for the issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 34.24%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
simplesamlphpsaml2
𝑥
< 4.17.0
CNA
Debian logo
Debian Releases
Debian Product
Codename
simplesamlphp
bookworm
1.19.7-1+deb12u2
fixed
bookworm (security)
vulnerable
forky
2.5.3.1-1
fixed
sid
2.5.3.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
simplesamlphp
bionic
Fixed 1.15.3-1ubuntu0.1~esm1
released
focal
Fixed 1.18.4-1ubuntu0.1~esm1
released
jammy
Fixed 1.19.1-1.1ubuntu0.1~esm1
released
noble
Fixed 1.19.7-1+deb12u1ubuntu0.1
released
oracular
ignored
plucky
ignored
questing
ignored
resolute
not-affected
xenial
Fixed 1.14.0-1ubuntu2+esm1
released
Common Weakness Enumeration
References
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L104-L113
https://github.com/simplesamlphp/saml2/blob/9545abd0d9d48388f2fa00469c5c1e0294f0303e/src/SAML2/HTTPRedirect.php#L178-L217
https://github.com/simplesamlphp/saml2/commit/7867d6099dc7f31bed1ea10e5bea159c5623d2a0
https://github.com/simplesamlphp/saml2/security/advisories/GHSA-46r4-f8gj-xg56
https://lists.debian.org/debian-lts-announce/2025/05/msg00013.html