CVE-2026-32600 - Vulnerability Analysis

Overview

xml-security < 2.3.1 and < 1.13.9 contains an authentication tag length validation bypass caused by missing validation in AES-GCM encrypted XML nodes, letting attackers decrypt nodes and forge ciphertexts, exploit requires crafted encrypted XML nodes.

Severity & Score

Impact

Attackers can decrypt encrypted XML nodes and forge ciphertexts, compromising confidentiality and integrity of data.

Mitigation

Update to versions 2.3.1 or 1.13.9 or later.

References

• https://github.com/simplesamlphp/xml-security/commit/cad6d57cf0a5a0b7e0cc4e4a5b18752e56eb1520
• https://github.com/simplesamlphp/xml-security/commit/fdc12449e959c610943f9fd428e95e3832d74c25
• https://github.com/simplesamlphp/xml-security/security/advisories/GHSA-r353-4845-pr5p

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner