The vulnerability in SimpleSAMLphp's HTTP-Artifact receive flow involves the SOAP ArtifactResponse receiving a TLS-based validator that incorrectly validates an unsigned embedded SAML Response. The validation logic delegates signature checks to the outer ArtifactResponse's TLS validator, which returns success even if the TLS public key does not match the expected key. Consequently, an ArtifactResponse from one IdP can validate an unsigned SAML Response claiming to be from a different IdP. In multi-IdP federations, this flaw allows a malicious or lower-trust IdP to authenticate as arbitrary users from a higher-trust IdP, enabling authentication bypass and identity-provider impersonation.

An attacker controlling a malicious or lower-trust IdP in the same federation can forge unsigned SAML assertions to authenticate to the SP as users from a different, higher-trust IdP. This compromises authentication integrity and allows impersonation of arbitrary users, including control over assertion attributes, NameID, and session data. The security boundary between IdPs is broken, undermining trust assumptions in federated identity deployments.

A fix is available in SimpleSAMLphp versions 6.2.1, 5.0.6, and 4.20.2 and later. Users should upgrade to these or newer versions to remediate the vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes. Patch status is confirmed by the affected version ranges indicating fixed versions. Immediate upgrade is recommended to prevent authentication bypass.