CVE-2026-32600 - Vulnerability Analysis

Overview

xml-security < 2.3.1 and < 1.13.9 contains an authentication tag length validation bypass caused by missing validation in AES-GCM encrypted XML nodes, letting attackers decrypt nodes and forge ciphertexts, exploit requires crafted encrypted XML nodes.

Severity & Score

Impact

Attackers can decrypt encrypted XML nodes and forge ciphertexts, compromising confidentiality and integrity of data.

Mitigation

Update to versions 2.3.1 or 1.13.9 or later.

References

• https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520
• https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25
• https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 16, 2026

🟠 CVE-2026-32600 - High (8.2) xml-security is a library that implements XML signatures and encryption. Prior to versions 2.3.1 and 1.13.9, XML nodes encrypted with either aes-128-gcm, aes-192-gcm, or aes-256-gcm lack validation of the authentication tag length. An attacker can... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32600/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner