Summary
onelogin/php-saml Improper signature validation on LogoutRequest/LogoutResponse.
In order to verify Signatures on Logoutrequests and LogoutResponses we use
the verifySignature of the class XMLSecurityKey from the xmlseclibs library.
That method end up calling openssl_verify() depending on the signature algorithm used.
The openssl_verify() function returns 1 when the signature was successfully verified,
0 if it failed to verify with the given key, and -1 in case an error occurs.
PHP allows translating numerical values to boolean implicitly, with the following correspondences:
- 0 equals false.
- Non-zero equals true.
This means that an implicit conversion to boolean of the values returned by openssl_verify()
will convert an error state, signaled by the value -1, to a successful verification of the
signature (represented by the boolean true).
The LogoutRequest/LogoutResponse signature validator was performing an implicit conversion to boolean
of the values returned by the verify() method, which subsequently will return the same output
as openssl_verify() under most circumstances.
This means an error during signature verification is treated as a successful verification by the method.
Since the signature validation of SAMLResponses were not affected, the impact of this security
vulnerability is lower, but an update of the php-saml toolkit is recommended.
Impact
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is GHSA-9WRW-P9RM-R782? GHSA-9WRW-P9RM-R782 is a low-severity security vulnerability in onelogin/php-saml (composer), affecting versions < 2.10.4. It is fixed in 2.10.4.
- Which versions of onelogin/php-saml are affected by GHSA-9WRW-P9RM-R782? onelogin/php-saml (composer) versions < 2.10.4 is affected.
- Is there a fix for GHSA-9WRW-P9RM-R782? Yes. GHSA-9WRW-P9RM-R782 is fixed in 2.10.4. Upgrade to this version or later.
- Is GHSA-9WRW-P9RM-R782 exploitable, and should I be worried? Whether GHSA-9WRW-P9RM-R782 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-9WRW-P9RM-R782 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-9WRW-P9RM-R782? Upgrade
onelogin/php-samlto 2.10.4 or later.