onelogin/php-saml
Simple SAML toolkit for PHP
View on Github
Activity
- Latest release
- 4mo ago
- Total releases
- 59
- Cadence
- ~12 days
- Last 12 months
- 6
Reach
- Stars
- 1.3k
Details
- License
- MIT
- First release
- Jun 04, 2014
| Version | Released | |
|---|---|---|
3.8.2
patch
| ||
4.3.2
patch
| ||
2.21.2
patch
| ||
3.8.1
patch
| ||
4.3.1
patch
| ||
2.21.1
patch
| ||
4.3.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.8.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.21.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.7.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.20.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
4.2.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
4.1.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
4.0.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.19.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
4.0.0
major
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.6.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.6.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.5.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.19.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.5.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.18.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.4.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.4.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.18.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.3.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.17.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.3.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.17.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.2.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.16.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.2.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
3.1.1
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v3.1.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v2.15.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v3.0.0
major
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v2.14.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v2.13.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
v2.12.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.11.0
minor
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.10.7
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.10.6
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.10.5
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.10.4
patch
1 CVE
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev | ||
2.10.3
patch
2 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev | ||
2.10.2
patch
2 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev | ||
2.10.1
patch
2 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev | ||
2.10.0
minor
2 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev | ||
2.9.1
patch
3 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2016-1000253
GHSA-g48f-pgwh-wwxx
May 17, 2024
onelogin/php-saml signature wrapping attacks
Medium
Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system. Affected versions
2.0.0
2.1.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
2.10.0
References Updated Dec 02, 2024 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev | ||
2.9.0
minor
3 CVEs
GHSA-5j8p-438x-rgg5
Dec 09, 2025
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Critical
Network
Low
None
None
Summary There is a critical vulnerability on xmlseclibs CVE-2025-66475, a dependency of php-saml Update to the following versions of php-saml which forces the use of patched versions of xmlseclibs: Impact Signature Wrapping Vulnerabilities allows an attacker to impersonate a user. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.11.0
2.16.0
+ 41 more Show less
2.17.0
2.17.1
2.18.0
2.18.1
2.19.0
2.19.1
2.20.0
2.21.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
v2.12.0
v2.13.0
v2.14.0
v2.15.0
3.1.1
3.2.0
3.2.1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.5.1
3.6.0
3.6.1
3.7.0
3.8.0
v3.0.0
v3.1.0
4.0.0
4.0.1
4.1.0
4.2.0
4.3.0
Fixed in
2.21.1
3.8.1
4.3.1
References
Updated Dec 09, 2025 · Source: OSV.dev
CVE-2016-1000253
GHSA-g48f-pgwh-wwxx
May 17, 2024
onelogin/php-saml signature wrapping attacks
Medium
Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system. Affected versions
2.0.0
2.1.0
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.9.0
2.9.1
Fixed in
2.10.0
References Updated Dec 02, 2024 · Source: OSV.dev
GHSA-9wrw-p9rm-r782
May 17, 2024
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
Low
In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify() function returns 1 when the signature was successfully verified, 0 if it failed to verify with the given key, and -1 in case an error occurs. PHP allows translating numerical values to boolean implicitly, with the following correspondences:
This means that an implicit conversion to boolean of the values returned by openssl_verify() will convert an error state, signaled by the value -1, to a successful verification of the signature (represented by the boolean true). The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean of the values returned by the verify() method, which subsequently will return the same output as openssl_verify() under most circumstances. This means an error during signature verification is treated as a successful verification by the method. Since the signature validation of SAMLResponses were not affected, the impact of this security vulnerability is lower, but an update of the php-saml toolkit is recommended. Affected versions
2.0.0
2.1.0
2.10.0
2.10.1
2.10.2
2.10.3
2.3.0
2.4.0
2.5.0
2.6.0
2.6.1
2.7.0
+ 3 more Show less
2.8.0
2.9.0
2.9.1
Fixed in
2.10.4
References Updated Dec 02, 2024 · Source: OSV.dev |