CVE-2018-7644

—

CVSS 3.0

7.5 high

EPSS

1%p67

Published

Mar 5, 2018 (Mar 5, 2018)

Modified

Jun 17, 2026

Description

The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.

Vendors: simplesamlphp
Products: simplesamlphp
Weakness: CWE-347
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.