LightSAML versions prior to 4.7.1 and between 5.0.0 and before 5.0.1 contain a vulnerability in the verification of cryptographic signatures on SAML assertions. The flaw allows an attacker to bypass authentication or escalate privileges by exploiting a mismatch in how LightSAML and xmlseclibs validate which assertion a signature covers. This occurs because the signature validation can be tricked into validating a hidden genuine assertion while LightSAML processes an attacker-controlled unsigned assertion. The issue is fixed in versions 4.7.1 and 5.0.1.