CVE-2026-49283

CVE-2026-49283 is a trust delegation vulnerability in SimpleSAMLphp's HTTP-Artifact binding implementation. The flaw isn't simply a missing signature check — it's a validation architecture that allows cryptographic trust to be silently re-delegated between the SOAP transport layer and the embedded assertion. When HTTPArtifact::receive() processes an artifact response, it validates the outer SOAP message against the artifact issuer's metadata, then discards that anchor and re-validates the inner assertion against a different issuer's metadata. SOAPClient::validateSSL() returning successfully on key mismatch is the mechanism, but the architectural choice to allow trust re-delegation across protocol layers is the root problem. In multi-IdP federations like eduGAIN, InCommon, or national e-ID federations, this is particularly dangerous. An attacker with valid federation membership can exploit the gap between transport trust and assertion trust: the SP believes it's communicating with a high-trust IdP because the artifact resolution endpoint is correct, but the actual assertion comes from wherever the attacker controls. No infrastructure compromise is required — only a legitimate federation account. Check whether your SimpleSAMLphp deployment uses HTTP-Artifact binding in a multi-IdP context. If you're running a single-IdP trust circle, you're not vulnerable regardless of binding. Audit custom modules and vendor forks for similar silent-validation-success patterns in SOAPClient::validateSSL() usage — the vulnerability pattern may exist elsewhere in code paths not covered by this CVE. The patched version (6.2.1) should be applied, but also review active sessions: an attacker exploiting this vulnerability can establish persistent sessions that will remain valid even after patching, because the SAML session cookie was issued under the vulnerable flow. This compounds remediation urgency — detection is difficult because the artifact resolution succeeds cleanly and logs appear normal.

Reviewed through automated stages and approved by a human before publication.