# SAML Single Sign On <= 6.1.0 - Unauthenticated Denial of Service via SAML Response Signature Transforms

- **ID:** WPSEC-2026-2176
- **Plugin:** SAML Single Sign On – SSO Login (`miniorange-saml-20-single-sign-on`), https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/
- **Affected versions:** all versions before 6.2.0
- **Fixed in:** 6.2.0 (Update to 6.2.0 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **Weakness:** CWE-400
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/miniorange-saml-20-single-sign-on
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2176/

## Description

The SAML Single Sign On plugin for WordPress is vulnerable to Denial of Service via the SAMLResponse parameter in all versions up to, and including, 6.1.0. This is due to the plugin canonicalizing SignedInfo, validating references and processing arbitrary signature transforms, including attacker-supplied XPath transform expressions, before any cryptographic signature verification, with no limit on the size of the submitted response. This makes it possible for unauthenticated attackers to submit crafted SAML responses that consume excessive server resources and degrade or deny service to the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-2176/
- https://plugins.svn.wordpress.org/miniorange-saml-20-single-sign-on/tags/6.2.0/
- https://wordpress.org/plugins/miniorange-saml-20-single-sign-on/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2176/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.