LOW3.0Packagist
GHSA-24m3-w8g9-jwpq· CVE-2020-5301Information disclosure of source code in SimpleSAMLphp
Modified: 7/8/2026
package
Packagist/simplesamlphp/simplesamlphp
pkg:packagist/simplesamlphp/simplesamlphp
MEDIUM6.1Packagist
GHSA-2qfc-48v5-4w5h· CVE-2018-6520SimpleSAMLphp Open redirection protection bypass
Modified: 4/25/2024
LOW3.7Packagist
GHSA-2r3v-q9x3-7g46Link injection in SimpleSAMLphp
Modified: 12/1/2024
MEDIUM5.9Packagist
GHSA-44pr-mgcp-v36r· CVE-2017-12870SimpleSAMLphp Unauthenticated encryption in CBC mode
Modified: 4/25/2024
MEDIUM5.9Packagist
GHSA-597c-mh7m-48v7· CVE-2017-12867SimpleSAMLphp Invalid token creation and validation
Modified: 4/25/2024
HIGH7.5Packagist
GHSA-5fj7-f8x3-q2mc· CVE-2011-4625simpleSAMLphp incorrectly handles XML encryption
Modified: 1/12/2024
MEDIUM4.4Packagist
GHSA-6gc6-m364-85ww· CVE-2020-5225Log injection in SimpleSAMLphp
Modified: 9/10/2026
MEDIUM5.3Packagist
GHSA-7wh8-jrq7-p27fSimpleSAMLphp exposes credentials in session storage
Modified: 12/3/2024
MEDIUM5.3Packagist
GHSA-9327-mqm6-x97j· CVE-2016-3124SimpleSAMLphp Information leakage issue in the sanitycheck module
Modified: 4/25/2024
MEDIUM6.1Packagist
GHSA-fv7m-wc3v-wr3w· CVE-2017-18121SimpleSAMLphp XSS Vulnerability
Modified: 2/16/2024
CRITICAL9.8Packagist
GHSA-gp2m-7cfp-h6gf· CVE-2017-12873Incorrect persistent NameID generation in SimpleSAMLphp
Modified: 2/16/2024
HIGH8.1Packagist
GHSA-j4qf-3w33-8cgc· CVE-2017-18122SimpleSAMLphp Signature validation bypass
Modified: 4/25/2024
CRITICAL9.8Packagist
GHSA-j96g-47x2-46hv· CVE-2017-12868SimpleSAMLphp Session fixation issue and authentication bypass in the authcrypt module
Modified: 4/25/2024
MEDIUM4.4Packagist
GHSA-mj9p-v2r8-wf8w· CVE-2020-5226Cross-site scripting in SimpleSAMLphp
Modified: 9/10/2026
MEDIUM6.3Packagist
GHSA-p9cm-r7jg-8q3g· CVE-2016-9955Incorrect signature verification in SimpleSAMLphp
Modified: 2/16/2024
MEDIUM5.9Packagist
GHSA-ppm4-r2vc-pg74SimpleSAMLphp Information Disclosure vulnerability
Modified: 12/3/2024
HIGH7.1Packagist
GHSA-q8r6-xj3f-wrrm· CVE-2026-49284SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
Modified: 9/10/2026
HIGH7.5Packagist
GHSA-qc43-78vj-vg7p· CVE-2017-12869SimpleSAMLphp Authentication context bypass in the multiauth module
Modified: 4/25/2024
CRITICAL9.8Packagist
GHSA-qv5p-6wrc-79wg· CVE-2018-6521SimpleSAMLphp Use of insecure connection charset (sqlauth module)
Modified: 12/7/2024
MEDIUM5.4Packagist
GHSA-v858-922f-fj9vSimpleSAMLphp Link Injection vulnerability
Modified: 12/3/2024
MEDIUM5.9Packagist
GHSA-v882-949x-6v28· CVE-2017-12872SimpleSAMLphp allows timing side-channel attacks
Modified: 2/16/2024
MEDIUM6.1Packagist
GHSA-vpr3-cw3h-prw8SimpleSAMLphp Reflected Cross-site Scripting vulnerability
Modified: 12/3/2024
MEDIUM5.9Packagist
GHSA-ww3w-592j-5qrw· CVE-2017-12871SimpleSAMLphp Incorrect IV generation for encryption
Modified: 4/25/2024