simplesamlphp — Vulnerabilities & Security Advisories 11

SimpleSAMLphp serves as a PHP-based solution for implementing SAML-based single sign-on across web applications. Historically, the software has been susceptible to multiple remote code execution vulnerabilities, cross-site scripting flaws, and privilege escalation issues, accounting for its 11 recorded CVEs. Notable security characteristics include its widespread adoption in academic and enterprise environments, which has made it a frequent target for attackers. Major incidents often involve misconfigurations leading to unauthorized access, with several critical RCE vulnerabilities discovered between 2018-2022 that allowed attackers to execute arbitrary code on affected servers. The project maintains regular security updates, but legacy deployments remain vulnerable.