CVE-2026-49289: 
PHP vulnerability analysis and mitigation

CVE-2026-49289 is a Denial-of-Service vulnerability in the SimpleSAMLphp SAML2 library caused by improper handling of XPath transforms in SAML messages. It affects simplesamlphp/saml2 and simplesamlphp/saml2-legacy versions up to and including 4.20.2 and 4.19.2. The vulnerability was first published on May 29, 2026, and added to the GitHub Advisory Database on July 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, SAML2 Advisory).

The root cause is uncontrolled resource consumption (CWE-400) stemming from the library's failure to restrict the type or number of XML transforms permitted in SAML messages. Specifically, XPath transforms — which can be computationally expensive — were not excluded from processing, allowing an attacker to craft SAML messages containing excessive or complex XPath transform chains that exhaust server resources. No authentication or user interaction is required; the attack is delivered over the network by sending a specially crafted SAML request to any endpoint that processes SAML2 messages using this library. The fix restricts transforms to only those algorithms specified in the SAML 2.0 Core Specification and explicitly refuses XPath transforms (GitHub Advisory, SAML2 Advisory).

Successful exploitation causes a Denial-of-Service condition against any service relying on the affected SimpleSAMLphp SAML2 library, rendering authentication and identity federation endpoints unavailable. There is no impact on confidentiality or data integrity — the attack is purely an availability concern. Any application using SimpleSAMLphp or the underlying simplesamlphp/saml2 or simplesamlphp/saml2-legacy Composer packages for SAML-based single sign-on is at risk of service disruption (GitHub Advisory).

1. Reconnaissance: Identify services using SimpleSAMLphp or the simplesamlphp/saml2 library for SAML-based authentication (e.g., SSO login endpoints, identity providers, service providers).
2. Craft malicious SAML message: Construct a SAML AuthnRequest or Response XML document containing a <ds:Transforms> element with one or more XPath transform entries (<ds:Transform Algorithm="http://www.w3.org/TR/1999/REC-xpath-19991116">) designed to trigger expensive server-side evaluation.
3. Embed complex XPath expressions: Include computationally intensive XPath expressions or a large number of chained transforms within the crafted message to maximize resource consumption on the target.
4. Submit to target endpoint: Send the crafted SAML message (e.g., via HTTP POST to the SAML assertion consumer service or SSO endpoint) repeatedly or in parallel to exhaust CPU/memory resources on the server.
5. Achieve DoS: The server becomes unresponsive or crashes due to resource exhaustion while processing the malicious transforms, denying service to legitimate users (GitHub Advisory, SAML2 Advisory).

• Network: Unusual volume of HTTP POST requests to SAML SSO or assertion consumer service endpoints from one or more source IPs; requests with abnormally large XML payloads.
• Logs: Web server or application logs showing repeated SAML processing requests with high latency or timeout errors; PHP error logs indicating excessive memory or CPU usage during XML/SAML parsing.
• Process: PHP worker processes consuming abnormally high CPU or memory; process hangs or crashes associated with XML transform processing.
• Application: Sudden unavailability or degraded performance of SimpleSAMLphp-based authentication endpoints coinciding with unusual inbound SAML traffic (GitHub Advisory).

Upgrade simplesamlphp/saml2 and simplesamlphp/saml2-legacy to version 4.20.3 or 4.19.3, which restrict XML transforms to only those algorithms permitted by the SAML 2.0 Core Specification and explicitly block XPath transforms. No configuration-based workaround is documented; patching is the recommended remediation. Organizations should update their Composer dependencies promptly using composer update simplesamlphp/saml2 (GitHub Advisory, SAML2 Advisory).