[HIGH] SimpleSAMLphp has Possible DoS via XPath Transform

PKSA-11bv-m3wk-h9sn CVE-2026-49289 GHSA-5cjr-mxj5-wmrx

Affected version: <=4.19.2|>=4.20.0,<=4.20.2

Reported by:
GitHub

[HIGH] SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

PKSA-4y26-97zb-p98g CVE-2026-49283 GHSA-6929-8p9f-26jx

Affected version: <4.19.3|>=4.20.0,<4.20.2

Reported by:
GitHub

[HIGH] The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding

PKSA-f546-f49f-cw9s CVE-2025-27773 GHSA-46r4-f8gj-xg56

Affected version: <=4.16.15

Reported by:
GitHub

[MEDIUM] SimpleSAMLphp SAML2 has an XXE in parsing SAML messages

PKSA-mvk4-j13p-n98v CVE-2024-52806 GHSA-pxm4-r5ph-q2m2

Affected version: <4.6.14

Reported by:
GitHub