Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/simplesamlphp/saml2@1.10.5
purl pkg:composer/simplesamlphp/saml2@1.10.5
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-wbt9-snjj-uuea Improper signature validation The `XmlSecLibs` library as used in the saml2 library in SimpleSAMLphp incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue. CVE-2018-7644
GHSA-923w-2xv2-7pr8

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-04T17:58:18.962689+00:00 GithubOSV Importer Fixing VCID-wbt9-snjj-uuea https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-923w-2xv2-7pr8/GHSA-923w-2xv2-7pr8.json 38.6.0
2026-06-02T04:37:33.794961+00:00 GitLab Importer Fixing VCID-wbt9-snjj-uuea https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/simplesamlphp/saml2/CVE-2018-7644.yml 38.6.0