CVE-2026-32600: 
PHP vulnerability analysis and mitigation

CVE-2026-32600 is a cryptographic bypass vulnerability in the simplesamlphp/xml-security PHP library, titled "Missing AES-GCM Authentication Tag Validation on Encrypted Nodes Allows for Unauthorized Decryption." The flaw affects all versions of the 1.x branch prior to 1.13.9 and all 2.x versions from 2.0.0 up to (but not including) 2.3.1. It was published on March 13, 2026, by maintainer tvdijen via a GitHub Security Advisory, with NVD analysis completed on March 16, 2026. The vulnerability carries a CVSS v3.1 base score of 8.2 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is improper validation of the AES-GCM authentication tag length (CWE-354: Improper Validation of Integrity Check Value). In src/Backend/OpenSSL.php, when decrypting XML nodes using aes-128-gcm, aes-192-gcm, or aes-256-gcm, the $authTag is extracted via PHP's substr() but its length is never validated against the expected 16-byte AUTH_TAG_LEN constant. Because PHP's substr() with a negative offset on a short string can return as little as one byte, an attacker can supply a crafted ciphertext blob containing only a nonce and a single-byte tag, causing the library to accept it as a valid authentication tag. This creates a format validation oracle: by iterating through all 256 possible byte values for each tag byte and observing HTTP 500 errors (indicating successful tag acceptance), an attacker can brute-force the full 16-byte GHASH authentication tag byte-by-byte. The advisory references an exploit script (nonce_reuse_with_fmt_val_oracle.py) that automates this attack (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated network attacker to decrypt XML nodes protected with AES-GCM encryption by observing server-side parsing differences (HTTP 500 responses acting as a decryption oracle). Beyond decryption, the attacker can recover the internal GHASH key, enabling offline computation of valid authentication tags for arbitrary ciphertexts — effectively allowing forgery of encrypted XML content without knowledge of the encryption key. In SAML deployments where symmetric keys are generated dynamically per SAMLResponse, the forgery impact is reduced, but any secrets embedded in XML (e.g., SAML assertions, identity attributes) can still be decrypted. Critically, if static symmetric encryption keys are in use, the recovered GHASH key may have already been compromised, enabling decryption of historical communications (Github Advisory).

A detailed proof-of-concept exploit is publicly available in the GitHub Security Advisory, including the exploit script nonce_reuse_with_fmt_val_oracle.py that automates the full attack against real SAML deployments. The advisory also includes a recorded demonstration video. No evidence of in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.011% (very low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made (Github Advisory).

1. Reconnaissance: Identify a target service that processes XML with AES-GCM encrypted nodes (e.g., a SAML Service Provider using simplesamlphp/xml-security versions < 2.3.1 or < 1.13.9). Confirm the endpoint returns HTTP 500 on decryption failures.
2. Obtain a legitimate ciphertext: Capture a valid SAMLResponse or XML document containing an <xenc:CipherValue> node encrypted with AES-GCM (e.g., aes-256-gcm).
3. Extract nonce: Base64-decode the <xenc:CipherValue> content and extract the first 12 bytes as the nonce (IV).
4. Brute-force the authentication tag byte-by-byte: For each of the 16 tag bytes, loop through all 256 possible byte values. Construct a crafted ciphertext blob consisting of only the nonce concatenated with the single candidate byte, Base64-encode it, replace the <xenc:CipherValue> content, and submit the modified XML to the target. An HTTP 500 response indicates the tag byte is accepted — record it and proceed to the next byte.
5. Recover the GHASH key: Using the brute-forced 16-byte tag and the empty ciphertext, compute the GCM GHASH key using known cryptographic techniques (as described in the referenced blog post on the OpenSSL issue).
6. Decrypt or forge ciphertexts: Use the recovered GHASH key to compute valid authentication tags for arbitrary ciphertexts offline, enabling decryption of the original encrypted XML content or forgery of new encrypted payloads. The exploit script nonce_reuse_with_fmt_val_oracle.py (run via sage -python nonce_reuse_with_fmt_val_oracle.py -s '<url-encoded-samlresponse>') automates steps 3–6 (Github Advisory).

• Network: High volume of HTTP POST requests to SAML assertion consumer endpoints (e.g., /saml/acs) with slightly varying SAMLResponse payloads; repeated requests differing only in the <xenc:CipherValue> field content.
• Logs: Clusters of HTTP 500 errors from the SAML processing endpoint in rapid succession (up to 256 × 16 = 4,096 requests per tag recovery attempt); application logs showing repeated XML decryption failures or RuntimeException: Authentication tag length is invalid (post-patch) or silent decryption errors (pre-patch).
• Network: Outbound connections or data exfiltration following a burst of 500-error requests, potentially indicating successful decryption and subsequent data theft.
• Application: Unexpected or malformed <xenc:CipherValue> values in received XML documents that are shorter than the expected nonce (12 bytes) + ciphertext + tag (16 bytes) minimum length (Github Advisory).

Upgrade simplesamlphp/xml-security to version 2.3.1 (for 2.x users) or version 1.13.9 (for 1.x users). The fix adds a strict length check on the extracted $authTag in src/Backend/OpenSSL.php, throwing a RuntimeException if the tag length does not equal the expected 16 bytes (AUTH_TAG_LEN). If static symmetric encryption keys were in use prior to patching, those keys must be rotated immediately, as the GHASH key may have been recovered by an attacker. No configuration-based workaround is available; upgrading is the only remediation (Github Advisory, Patch Commit, Red Hat Bugzilla).

The vulnerability was credited to researcher "Sideni" and disclosed responsibly through GitHub's security advisory process by maintainer tvdijen. Red Hat tracked the issue via Bugzilla (Bug 2447983) with medium severity, indicating awareness in enterprise Linux distributions that package SimpleSAMLphp. A Bluesky post from cyberhub.blog was observed in late March 2026, suggesting some community discussion. No major media coverage or significant public controversy has been identified beyond standard vulnerability tracking (Github Advisory, Red Hat Bugzilla).