CVE-2024-52806: Simplesamlphp SAML2

High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days.

SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.

Affected products

• Simplesamlphp SAML2: before 4.6.14 (fixed in 4.6.14); from 5.0.0-alpha.1, before 5.0.0-alpha.18 (fixed in 5.0.0-alpha.18); up to and including 5.0.0-alpha.1; before 5.0.0-alpha.18 (fixed in 5.0.0-alpha.18)

Published 2024-12-02. Last modified 2026-06-17.