The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
CVE-2026-63182: LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-63182
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers, before versions 4.7.1 and 5.0.1. `XMLSecurityDSig::validateReference()` resolves `Reference URI="#id"` document-wide and takes `item(0)`, so an attacker can place a genuine signed assertion's bytes in `samlp:Extensions` and present a forged direct-child assertion with the same ID. Validation covers the hidden bytes while LightSAML consumes unsigned `Subject/NameID`, `Conditions` and `Attributes`, enabling authentication bypass or privilege escalation. Confirmed in 5.0.0 and 4.6.1.
Mitigation
Fixed in versions 4.7.1 and 5.0.1.