The SimpleSAMLphp SAML2 library, a PHP library for SAML2, contains a flaw in the HTTPArtifact::receive() flow that lets an unsigned embedded SAML Response be treated as cryptographically valid for the wrong identity provider. The flaw arises because the SOAPClient attaches a TLS validator to the outer ArtifactResponse, while the embedded response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than the artifact issuer. Consequently, SOAPClient::validateSSL() may return normally when the TLS public key does not match, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a federation with multiple identity providers, a malicious or lower‑trust IdP can supply an ArtifactResponse containing an unsigned Response that claims a higher‑trust victim IdP as issuer, enabling authentication as arbitrary users with attacker‑chosen assertion attributes, NameID, and session data.

The vulnerability affects the SimpleSAMLphp SAML2 library in versions prior to 4.19.3, 4.20.2, 5.0.6, and 6.2.1. Any application that deploys this library for SAML2 authentication in a multi‑IdP federation environment, where multiple identity providers are trusted, is susceptible to this flaw.

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score is < 1 %, indicating a low probability that it is widely exploited in the wild, but once an attacker controls a low‑trust IdP and can supply a crafted ArtifactResponse the vulnerability remains potent. The weakness reflects improper TLS validation (CWE-295) and permits unauthorized authentication in federated environments. The vulnerability is not listed in the CISA KEV catalog, which underscores the need for vigilance, but the impact—unauthorized user impersonation—justifies immediate patching.