CVE-2024-52806: SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

Severity: high (CVSS 8.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-02 · updated 2026-06-17
Weakness: CWE-611

Description

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Affected products

simplesamlphp saml2: before 4.6.14; through 5.0.0-alpha.1; before 5.0.0-alpha.18 — fixed in 4.6.14, 5.0.0-alpha.18

How to fix

Upgrade to a fixed version: simplesamlphp saml2 4.6.14, 5.0.0-alpha.18. Check the vendor advisory for mitigations.

References

https://github.com/simplesamlphp/saml2/commit/5fd4ce4596656fb0c1278f15b8305825412e89f7
https://github.com/simplesamlphp/saml2/security/advisories/GHSA-pxm4-r5ph-q2m2

Get alerted when CVE-2024-52806 or the next vulnerability affects your stack