The SimpleSAMLphp Service Provider (SP) fails to validate that an incoming SAML Response comes from the IdP that was chosen for the authentication flow. When a Response element lacks an InResponseTo attribute and the assertion also omits the SubjectConfirmationData/InResponseTo value, the SP accepts the message. The description labels this as an information disclosure vulnerability, and based on the description it is inferred that an attacker could read or manipulate authentication state or other sensitive data. The CWE-345 designation highlights the lack of proper identity verification leading to unintended information exposure.

SimpleSAMLphp releases earlier than version 2.4.7, earlier than 2.5.2, and all 1.x releases before 1.18.6 are affected. These versions contain the flaw that allows a Response from an unexpected IdP to be bound to an SP session state created for another IdP.

The CVSS score of 7.1 signifies moderate to high severity, while the EPSS score of less than 1% indicates a low current exploitation probability, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is remote: an adversary can craft a SAML Response that satisfies the signed assertion requirement and send it to the SP's Assertion Consumer Service endpoint. Based on the description it is inferred that the attacker would need either a trusted IdP capable of issuing the Response or a compromised signing key for the assertion, and that active exploitation data are not confirmed. If the SP allows unsolicited responses, the vulnerability enables unauthorized binding of the assertion to session state created for a different IdP, potentially exposing sensitive data.