Skip to content
OpenAdvisories

Package · Packagist

onelogin/php-saml

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical —
    GHSA-5j8p-438x-rgg5

    SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

    **Summary** There is a critical vulnerability on xmlseclibs [CVE-2025-66475](https://github.com/robrichards/xmlseclibs/security/advisories/GHSA-c4cc-x928-vjw9), a dependency of php-saml Update to the following versions of php-saml which forces the use of patc…

    onelogin/php-saml Packagist
  • Medium —
    CVE-2016-1000253

    onelogin/php-saml signature wrapping attacks

    Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.

    onelogin/php-saml Packagist
  • Low —
    GHSA-9wrw-p9rm-r782

    onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.

    In order to verify Signatures on Logoutrequests and LogoutResponses we use the verifySignature of the class XMLSecurityKey from the xmlseclibs library. That method end up calling openssl_verify() depending on the signature algorithm used. The openssl_verify()…

    onelogin/php-saml Packagist