CVE-2026-63182

The LightSAML library (versions prior to 4.7.1 and 5.0.1 ) is vulnerable to a signature reference wrapping issue. Due to a discrepancy between LightSAML and xmlseclibs regarding which assertion a signature covers, the AssertionSignatureValidatorAction may validate a signature against the wrong as...

CVE-2026-63182: litesaml lightsaml: LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate…

LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. Response::deserialize uses...