CVE-2025-31335: Shibboleth Opensaml C++ Library

Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days.

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

Affected products

• Shibboleth Opensaml C++ Library: before 3.3.1 (fixed in 3.3.1)

Published 2025-03-28. Last modified 2026-06-17.