Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

mrrootsec/simplesamlphp

              master @ 007a025
            

282

Fixes

CVEs

CRITICAL

Peak severity

48.6%

Coverage

Highlights

Auth Bypass: 89 prior fixes. Scrutinize any change in this area.

lib/SimpleSAML/Utilities.php: most-fixed (15 issues). Treat as high-risk during review.

131 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Insecure handling of SAML assertions, such as lenient issuer matching and weak signature enforcement, allows remote attackers to bypass identity provider (IdP) authentication. Strict validation of 'ExpectedIssuer' and conforming to SAML2Int signature standards are required.

Cryptographic Issues: Weaknesses in validating the return value of signature-verification operations (such as loose comparison checks on verification return values) historically allowed remote attackers to completely bypass XML signature validation.

Cryptographic Issues: The use of legacy, non-authenticated symmetric encryption (like AES-CBC without HMAC) and predictable IV generation derived from keys left session identifiers and redirect information vulnerable to padding oracle and modification attacks.