CVE-2025-31335

4.0 MEDIUM

Published: March 28, 2025 Modified: April 15, 2026

Description

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation (when using SAML bindings that rely on non-XML signatures).

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

https://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=22a610b322e2178abd03e97cdbc8fb50b45efaee

Source: cve@mitre.org

https://lists.debian.org/debian-security-announce/2025/msg00041.html

Source: cve@mitre.org

https://shibboleth.atlassian.net/browse/CPPOST-126

Source: cve@mitre.org

https://shibboleth.net/community/advisories/secadv_20250313.txt

Source: cve@mitre.org

4 reference(s) from NVD

Quick Stats

CVSS v3 Score

4.0 / 10.0

EPSS (Exploit Probability)

0.1%

35th percentile

Exploitation Status

Not in CISA KEV

Weaknesses (CWE)

CWE-347

Related CVEs