Vulnerabilities / SAML Single Sign On / WPSEC-2026-2176
SAML Single Sign On <= 6.1.0 - Unauthenticated Denial of Service via SAML Response Signature Transforms
High 7.5
CWE-400Fixed in 6.2.0
- ID
- WPSEC-2026-2176
- Plugin
- SAML Single Sign On – SSO Login (miniorange-saml-20-single-sign-on)
- Affected
- all versions before 6.2.0
- Remediation
- Update to 6.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness
- CWE-400
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-31
- Attack surface
- SAML Single Sign On on WPSec AttackSurface
- Fix released
- Published
Description
The SAML Single Sign On plugin for WordPress is vulnerable to Denial of Service via the SAMLResponse parameter in all versions up to, and including, 6.1.0. This is due to the plugin canonicalizing SignedInfo, validating references and processing arbitrary signature transforms, including attacker-supplied XPath transform expressions, before any cryptographic signature verification, with no limit on the size of the submitted response. This makes it possible for unauthenticated attackers to submit crafted SAML responses that consume excessive server resources and degrade or deny service to the site.
References
- https://wpsec.com/vuln/WPSEC-2026-2176/
- https://plugins.svn.wordpress.org/miniorange-saml-20-single-sign-on/tags/6.2.0/
- https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS