Problem/Motivation

This is a security issue in an external library.

SAML PHP Toolkit released new versions on December 9, 2025, to force an upgrade to xmlseclibs, which was vulnerable to CVE-2025-66475.

Proposed resolution

The SAML SP module currently requires SAML PHP Toolkit versions greater than 3.7.0 or 4.2.0. We should change those minimums to 3.8.1 or 4.3.1.

Remaining tasks

Before merging we should verify that changes in SAML PHP Toolkit versions 3.8.0 and 4.3.0 don’t break anything this module does. It’s unlikely to be a problem (I hope everyone using SAML SP has already updated those libraries), but I know we have done some work around validUntil, so it’s worth exploring exactly what changed.

User interface changes

None.

API changes

None.

Data model changes

None.

Issue fork saml_sp-3574865

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

About issue forks

Comments

jproctor created an issue. See original summary.

jproctor opened merge request !71

jproctor’s picture

jproctor
they/them
Primary language English
commented
Issue summary: View changes
jproctor’s picture

jproctor
they/them
Primary language English
commented
Status: Active » Needs review

Looks like we got caught up on all the validUntil changes for 3.8.0 and 4.3.0 last May in #3526580: Add $ignoreValidUntil, as onelogin has updated the Settings base class. and released already.

I’ve tried 3.8.1 and 4.3.1 in D9 (PHP 7.3), D10 (PHP 8.4), D11 (PHP 8.4) and haven’t run across any problems with my config, but ugh we really gotta get some tests in this code sometime. Gonna let this sit in “Needs review“ until maybe thursday 26 Feb to encourage anyone else who wants to look, then merge for a new release.

jproctor’s picture

jproctor
they/them
Primary language English
commented
Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.