CVE-2017-12869

The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input.

• CWE-20

• https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
• https://simplesamlphp.org/security/201704-02Patch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4127Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2017/12/msg00007.htmlMailing List, Third Party Advisory
• https://simplesamlphp.org/security/201704-02Patch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4127Third Party Advisory

Published

Sep 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12862In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer…8.8
• CVE-2017-12863In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMD…8.8
• CVE-2017-12864In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function Read…8.8
• CVE-2017-12865Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 …9.8
• CVE-2017-12867The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp …
• CVE-2017-12868The secureCompare method in lib/SimpleSAML/Utils/Crypto.php …
• CVE-2017-1287IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to…
• CVE-2017-12870SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-…
• CVE-2017-12871The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in …
• CVE-2017-12872The (1) Htpasswd authentication source in the authcrypt modu…
• CVE-2017-12873SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to…
• CVE-2017-12874The InfoCard module 1.0 for SimpleSAMLphp allows attackers t…