CVE-2026-63182
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In LightSAML prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. XMLSecurityDSig::validateReference() removes the enveloped signature from the shared DOM, but processRefNode() resolves Reference URI="#id" document-wide via XPath //*[@Id] and takes item(0), which need not be the assertion whose claims LightSAML consumes. An attacker with a captured genuinely signed assertion can place its signature-stripped bytes in samlp:Extensions and present a forged assertion with the same ID and copied signature, enabling authentication bypass or privilege escalation.
Risk Assessment
It may enable SAML authentication bypass or privilege escalation even when signature validation is required. The risk affects service and identity providers using LightSAML.
Recommendation
Update LightSAML to version 4.7.1 or 5.0.1 (or later). Verify SAML signature validation configuration and monitor for anomalous assertions.
Related vulnerabilities
- CVE-2026-120534Critical
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. Insufficient validation of form configuration parameters allows unauthenticated attackers to call arbitrary WordPress functions with controlled arguments.
- CVE-2026-120518Critical
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. The bpxp_image_field_update_on_user_activation() function calls unlink() on a path built from visitor-supplied signup metadata without realpath() resolution, containment check, or extension allow-list.
- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2026-97718Critical
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
- CVE-2026-102435Critical
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation.
- CVE-2026-105606Critical
The Joomla Custom Tables extension before 3.7.8 allows an unauthenticated attacker to upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory. The stored path is disclosed in the response, and the file is served as static content by default.
- CVE-2026-105604Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unauthenticated SQL injection in the frontend search.
- CVE-2026-105603Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unprivileged file upload, leading to full remote code execution (RCE).
- CVE-2026-88811Critical
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.
Original NVD description (English source)
LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to collect only direct-child `saml:Assertion` elements of `samlp:Response`, and `AssertionSignatureValidatorAction` validates their `ds:Signature` using an out-of-band trusted IdP credential resolved by Issuer, not a key from the document. `XMLSecurityDSig::validateReference()` removes the enveloped signature from the shared DOM, but `processRefNode()` resolves `Reference URI="#id"` document-wide through an XPath of the form `//*[@Id]` and takes `item(0)`, which need not be the assertion whose claims LightSAML consumes. An attacker who has captured one genuinely signed assertion, such as an earlier login response, can place its signature-stripped bytes earlier in `samlp:Extensions` and present a forged direct-child assertion with the same ID and copied genuine signature. Validation then covers the hidden genuine bytes while LightSAML surfaces unsigned attacker-controlled `Subject/NameID`, `Conditions`, and `Attributes`, enabling authentication bypass or privilege escalation even when signature validation is required. The behavior was confirmed in versions 5.0.0 and 4.6.1. This issue is fixed in versions 4.7.1 and 5.0.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS