CVE-2018-6520: Simplesamlphp

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

SimpleSAMLphp before 1.15.2 allows remote attackers to bypass an open redirect protection mechanism via crafted authority data in a URL.

Affected products

• Simplesamlphp Simplesamlphp: from 1.12.0, before 1.15.1 (fixed in 1.15.1)

Published 2018-02-02. Last modified 2026-06-17.