Composer simplesamlphp/saml2-legacy has 4 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2026-49289 | SimpleSAMLphp has Possible DoS via XPath Transform | high | 7.5 | >=4.20.0 and <4.20.3 or <4.19.3 | 4.20.3, 4.19.3 |
| CVE-2026-49283 | SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass | high | 8.7 | >=4.20.0 and <4.20.2 or <4.19.3 | 4.20.2, 4.19.3 |
| CVE-2024-52806 | SimpleSAMLphp SAML2 has an XXE in parsing SAML messages | high | 8.3 | <4.6.14 | 4.6.14 |
| CVE-2025-27773 | The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding | high | 8.6 | <4.17.0 | 4.17.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked