Threats Tagged 'ghsa-q8r6-xj3f-wrrm'
View all threats tagged with 'ghsa-q8r6-xj3f-wrrm'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-q8r6-xj3f-wrrm'
Click on any threat for detailed analysis and mitigation recommendations
GHSA-q8r6-xj3f-wrrm: SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`CVE-2026-49284 0 SimpleSAMLphp versions before 2.4.7 and from 2.5.0 up to but not including 2.5.2 contain a vulnerability where the service provider (SP) accepts SAML responses from an unexpected identity provider (IdP) under certain conditions. Specifically, if the SP expects a response from IdP A but receives a valid response from IdP B, the response is processed instead of rejected when the response's InResponseTo attribute is unsigned and the signed assertion lacks its own InResponseTo. This can lead to authentication and authorization bypass in multi-IdP deployments where different IdPs have varying trust levels or tenant boundaries. Join the discussion | GCVE Database | 07/02/2026, 20:47:21 UTC Added: 07/02/2026, 22:56:46 UTC |
Showing 1 to 1 of 1 result