[HIGH] SimpleSAMLphp has Possible DoS via XPath Transform

PKSA-1fc7-xrz7-vw78 CVE-2026-49289 GHSA-5cjr-mxj5-wmrx

Affected version: <=4.20.2

Reported by:
GitHub

[HIGH] SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

PKSA-yk3g-3g3t-ts6q CVE-2026-49283 GHSA-6929-8p9f-26jx

Affected version: <4.20.2|>=5.0.0,<5.0.6|>=6.0.0,<6.2.1

Reported by:
GitHub