CVE-2017-18122

A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP.

• CWE-347

• https://lists.debian.org/debian-lts-announce/2018/02/msg00008.htmlMailing List, Third Party Advisory
• https://simplesamlphp.org/security/201710-01Patch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4127Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/02/msg00008.htmlMailing List, Third Party Advisory
• https://simplesamlphp.org/security/201710-01Patch, Vendor Advisory
• https://www.debian.org/security/2018/dsa-4127Third Party Advisory

Published

Feb 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18111The OAuthHelper in Atlassian Application Links before versio…
• CVE-2017-18112Affected versions of Atlassian Fisheye allow remote attacker…6.5
• CVE-2017-18113The DefaultOSWorkflowConfigurator class in Jira Server and J…8.8
• CVE-2017-1812Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18120A double-free bug in the read_gif function in gifread.c in g…
• CVE-2017-18121The consentAdmin module in SimpleSAMLphp through 1.14.15 is …
• CVE-2017-18123The call parameter of /lib/exe/ajax.php in DokuWiki through …
• CVE-2017-18124During secure boot, addition is performed on uint8 ptrs whic…
• CVE-2017-18125In Android before security patch level 2018-04-05 on Qualcom…
• CVE-2017-18126In Android before security patch level 2018-04-05 on Qualcom…
• CVE-2017-18127In Android before security patch level 2018-04-05 on Qualcom…
• CVE-2017-18128In Android before security patch level 2018-04-05 on Qualcom…