CVE-2023-49087

xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on the SignedInfo-tree (the one that contains the DigestValue) verifies and matches a trusted public key. If an attacker somehow (i.e. by exploiting a bug in PHP's canonicalization function) manages to manipulate the canonicalized version's DigestValue, it would be possible to forge the signature. This issue has been patched in version 1.6.12 and 5.0.0-alpha.13.

• CWE-345

• https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581Patch
• https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6rExploit, Vendor Advisory
• https://github.com/simplesamlphp/xml-security/commit/f509e3083dd7870cce5880c804b5122317287581Patch
• https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-ww7x-3gxh-qm6rExploit, Vendor Advisory

Published

Nov 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-49081aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49082aiohttp is an asynchronous HTTP client/server framework for …5.3
• CVE-2023-49083cryptography is a package designed to expose cryptographic p…7.5
• CVE-2023-49084Cacti is a robust performance and fault management framework…8.8
• CVE-2023-49085Cacti provides an operational monitoring and fault managemen…8.8
• CVE-2023-49086Cacti is a robust performance and fault management framework…5.4
• CVE-2023-49088Cacti is an open source operational monitoring and fault man…4.8
• CVE-2023-49089Umbraco is an ASP.NET content management system (CMS). Start…6.5
• CVE-2023-4909Inappropriate implementation in Interstitials in Google Chro…4.3
• CVE-2023-49090CarrierWave is a solution for file uploads for Rails, Sinatr…6.1
• CVE-2023-49091Cosmos provides users the ability self-host a home server by…9.8
• CVE-2023-49092RustCrypto/RSA is a portable RSA implementation in pure Rust…5.9