SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Simplesamlphp | Simplesamlphp | 1.7.0 (including) | 1.14.10 (including) |
| Simplesamlphp | Ubuntu | esm-apps/xenial | * |
| Simplesamlphp | Ubuntu | trusty | * |
| Simplesamlphp | Ubuntu | upstream | * |
| Simplesamlphp | Ubuntu | xenial | * |
| Simplesamlphp | Ubuntu | zesty | * |
Such a scenario is commonly observed when: