{"id":"GHSA-g48f-pgwh-wwxx","aliases":["CVE-2016-1000253"],"title":"onelogin/php-saml signature wrapping attacks","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.","severity":"medium","score":null,"published":"2024-05-17T23:06:55.000Z","modified":"2024-12-02T05:43:41.569Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"onelogin/php-saml","sources":[{"name":"OSV · GHSA-g48f-pgwh-wwxx","url":"https://osv.dev/vulnerability/GHSA-g48f-pgwh-wwxx"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2.10.0"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.1.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.7.0","2.8.0","2.9.0","2.9.1"],"fixed":["2.10.0"]}],"sourceAffected":[],"references":["https://github.com/onelogin/php-saml/commit/9d31baa97a57b0989020f62d24307c29e325dac3","https://github.com/FriendsOfPHP/security-advisories/blob/master/onelogin/php-saml/CVE-2016-1000253.yaml","https://github.com/SAML-Toolkits/php-saml"],"sources":[{"name":"OSV","id":"GHSA-g48f-pgwh-wwxx","modified":"2024-12-02T05:43:41.569634Z","url":"https://osv.dev/vulnerability/GHSA-g48f-pgwh-wwxx"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T17:10:31.931Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}