Shibboleth OIDC OP <3.0.4 - Server-Side Request Forgery

The Shibboleth Identity Provider OIDC OP plugin before 3.0.4 is vulnerable to server-side request forgery SSRF due to insufficient restriction of the requesturi parameter, which allows attackers to interact with arbitrary third-party HTTP services. id: CVE-2022-24129 info: name: Shibboleth OIDC O...

CVE-2021-36394-Pre-Auth-RCE-in-Moodle

CVE-2021-36394-Pre-Auth-RCE-in-Moodle Vulnerability Introduction Moodle is the most popular learning management system in the world. Start creating your eLearning website in minutes! An unauthorized remote code execution vulnerability exists in the Shibboleth authentication module of Moodle. This...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Shibboleth vulnerability (USN-8768-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8768-1 advisory. Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibl...

USN-8768-1 shibboleth-sp vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...

USN-8768-1: Shibboleth vulnerability

Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibly use this issue to perform SQL injection attacks and obtain sensitive information...

Astra Linux – Vulnerability in xmltooling

Shibboleth XMLTooling before version 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allowed SSRF through a specially crafted KeyInfo element. This issue has been fixed, for example, in Shibboleth Service Provider 3.4.1.3 on Windows...

...[ More ]

ILIAS versions prior to 9.22, versions 10.0 through 10.9, and versions 11.0 through 11.2 contain an unauthenticated PHP object injection vulnerability in the Shibboleth logout functionality. An unauthenticated attacker can manipulate stored session data that is subsequently deserialized without...

CVE-2026-80428

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428

ILIAS (e-learning platform) is vulnerable to unauthenticated PHP object injection via its Shibboleth back-channel endpoint (shib_logout.php). The endpoint's logout-notification handler deserialises all live session rows without restricting constructable classes, and runs in a context exempt from ...

EUVD-2026-66602

ILIAS deserialises stored session data for an unauthenticated caller. The Shibboleth back-channel endpoint at components/ILIAS/AuthShibboleth/resources/shiblogout.php runs in a context that ilInitialisation exempts from authentication, and its logout-notification handler locates the session to...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428 ILIAS PHP Object Injection via Shibboleth Logout

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

CVE-2026-80428: Deserialization of Untrusted Data

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth...

PT-2026-82214

Name of the Vulnerable Software and Affected Versions ILIAS affected versions not specified Description An unauthenticated caller can trigger the deserialization of stored session data. The Shibboleth back-channel endpoint 'components/ILIAS/AuthShibboleth/resources/shib logout.php' operates in a...

CVE-2024-6832

The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials witho...

SUSE SLES16 Security Update : shibboleth-sp (SUSE-SU-2026:22854-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22854-1 advisory. This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the...

openSUSE 16: libshibsp-lite12 / libshibsp12 / shibboleth-sp / etc (openSUSE-SU-2026:21418-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21418-1 advisory. This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the ID attribute of the SAML response when the replay cache of...

Security update for shibboleth-sp (important)

openSUSE security update: security update for shibboleth-sp ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21418-1 Rating: important References: bsc1249394 Cross-References: CVE-2025-9943 CVSS scores: CVE-2025-9943 SUSE : 7.3...

SUSE-SU-2026:22854-1 Security update for shibboleth-sp

This update for shibboleth-sp fixes the following issue - CVE-2025-9943: SQL injection in the "ID" attribute of the SAML response when the replay cache of the Shibboleth Service Provider SP is configured to use an SQL database as storage service bsc1249394...