# CVE-2026-63182

Published articles for CVE-2026-63182.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## CVE-2026-63182 - LightSAML: Signature reference wrapping permits unsigned assertion claims

DevFeed: [CVE-2026-63182 - LightSAML: Signature reference wrapping permits unsigned assertion claims](<https://devfeed.tech/articles/cve-2026-63182-lightsaml-signature-reference-wrapping-permits-unsigned-assertion-claims-109477.md>)

Original publisher: [Read original article](<https://cvefeed.io/vuln/detail/CVE-2026-63182>)

Author: CVEFEED.io; github.com

Published: 2026-10-30T22:16:58Z

Content type: news

Language: en

Sources: [Latest High/Critical Vulnerabilitiy Feed](<https://devfeed.tech/sources/latest-high-critical-vulnerabilitiy-feed.md>)

Topics: [saml](<https://devfeed.tech/topics/saml.md>), [signed data](<https://devfeed.tech/topics/signed-data.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authentication-bypass](<https://devfeed.tech/tags/authentication-bypass.md>), [certificate](<https://devfeed.tech/tags/certificate.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-63182](<https://devfeed.tech/tags/cve-2026-63182.md>), [cvss](<https://devfeed.tech/tags/cvss.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [out-of-band](<https://devfeed.tech/tags/out-of-band.md>), [privilege-escalation](<https://devfeed.tech/tags/privilege-escalation.md>), [saml](<https://devfeed.tech/tags/saml.md>), [security](<https://devfeed.tech/tags/security.md>), [serialization](<https://devfeed.tech/tags/serialization.md>), [validation](<https://devfeed.tech/tags/validation.md>), [xml](<https://devfeed.tech/tags/xml.md>), [xpath](<https://devfeed.tech/tags/xpath.md>)

### AI overview

Before LightSAML 4.7.1 and 5.0.1, signature validation can cover a different SAML assertion from the one whose claims LightSAML uses. xmlseclibs resolves a signature reference by searching the entire XML document for a matching ID and selecting the first result, while LightSAML consumes direct-child assertions. An attacker with a captured signed assertion can place its signature-stripped contents earlier in the response's Extensions and reuse its ID and signature on a forged assertion. Validation may then succeed on the hidden signed data while LightSAML accepts attacker-controlled claims, potentially enabling authentication bypass or privilege escalation. The behavior was confirmed in versions 5.0.0 and 4.6.1; fixes are available in 4.7.1 and 5.0.1.

### Source excerpt

CVE ID :CVE-2026-63182 Published : Oct. 30, 2026, 10:16 p.m. | 1 hour, 39 minutes ago Description :LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to collect only direct-child `saml:Assertion` elements of `samlp:Response`, and `AssertionSignatureValidatorAction` validates their `ds:Signature` using an out-of-band trusted IdP credential resolved by Issuer, not a key from the document. `XMLSecurityDSig::validateReference()` removes the enveloped signature from the shared DOM, but `processRefNode()` resolves `Reference URI="#id"` document-wide through an XPath of the form `//*[@Id]` and takes `item(0)`, which need not be the assertion whose claims LightSAML consumes. An attacker who has captured one genuinely signed assertion, such as an earlier login response, can place its signature-stripped bytes earlier in `samlp:Extensions` and present a forged direct-child assertion with the same ID and copied genuine signature. Validation then covers the hidden genuine bytes while LightSAML surfaces unsigned attacker-controlled `Subject/NameID`, `Conditions`, and `Attributes`, enabling authentication bypass or privilege escalation even when signature validation is required. The behavior was confirmed in versions 5.0.0 and 4.6.1. This issue is fixed in versions 4.7.1 and 5.0.1. Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...