24 matches found
CVE-2026-63182
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...
CVE-2026-63182
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. "Response::deserialize" uses...
CVE-2026-63182
The LightSAML library (versions prior to 4.7.1 and 5.0.1 ) is vulnerable to a signature reference wrapping issue. Due to a discrepancy between LightSAML and xmlseclibs regarding which assertion a signature covers, the AssertionSignatureValidatorAction may validate a signature against the wrong as...
CVE-2026-63182 LightSAML: Signature reference wrapping permits unsigned assertion claims
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...
EUVD-2026-114520
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...
CVE-2026-63182 LightSAML: Signature reference wrapping permits unsigned assertion claims
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...
CVE-2026-63182: litesaml lightsaml: LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate…
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...
PT-2026-134227
Name of the Vulnerable Software and Affected Versions LightSAML versions prior to 4.7.1 LightSAML versions prior to 5.0.1 Description LightSAML and xmlseclibs have a discrepancy regarding which assertion an inbound SAML signature covers. The Response::deserialize function uses manyElementsFromXml...
Signature validation bypass
More info at https://github.com/litesaml/lightsaml/security/advisories/GHSA-rm7m-7jq4-gw46...
CVE-2026-69092
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
CVE-2026-69092
CVE-2026-69092 affects Admidio versions before 5.0.11. The issue is a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or Ligh...
CVE-2026-69092: Improper Neutralization of Input During Web Page Generation
Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echoes unencoded exception messages to the HTTP response. Unauthenticated attackers can inject arbitrary JavaScript through SAML Issuer elements or LightSaml library parameters to...
EUVD-2022-5353
Malicious code in bioql PyPI...
GHSA-VG4F-8V9Q-5C3X LightSAML Incorrect Access Control vulnerability
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...
LightSAML Incorrect Access Control vulnerability
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...
Incorrect Access Control
lightsaml/lightsaml is vulnerable to incorrect access control. The vulnerability exists in the signature validation found in readers of src/LightSaml/Model/XmlDSig/ that could allow a malicious user to impersonate other users from the Identity Provider...
CVE-2018-1000165
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...
Improper access control
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...
CVE-2018-1000165
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...
CVE-2018-1000165
LightSAML version prior to 1.3.5 contains a Incorrect Access Control vulnerability in signature validation in readers in src/LightSaml/Model/XmlDSig/ that can result in impersonation of any user from Identity Provider. This vulnerability appears to have been fixed in 1.3.5 and later...