What’s Vulnerable › Vulnerabilities
CVE-2018-7644
- Severity: high (CVSS 7.5 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2018-03-05 · updated 2026-06-17
- Weakness: CWE-347
Description
The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.
Affected products
- simplesamlphp: before 1.15.3 — fixed in 1.15.3
How to fix
Upgrade to a fixed version: simplesamlphp 1.15.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2018-7644 or the next vulnerability affects your stack