-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Identity Provider Plugin Security Advisory [9 November 2026]

An updated version of the OpenID Connect OP plugin for the Shibboleth
Identity Provider is now available which corrects a deficiency in the
encoding of response parameters with the form_post response mode.

This issue is considered of "medium" to "high" security importance
to deployments. The "high" importance is considered for versions before
V4.1.0 or when Content Security Policy (CSP) has been disabled since
that version.

OpenID Connect OP plugin leaves form_post parameter values unescaped
======================================================================
The OAuth 2 (and OpenID Connect) specifications allow for a variety
of methods for an OAuth client (the relying party) to request how the
authorization/authentication response is returned to its redirection
URI. One of these methods is Form Post Response Mode [1]. In this mode,
the response parameters are encoded as HTML form values that the user
agent automatically submits back to the client.

The OP plugin left those response parameters unescaped, including the
authorization/authentication request parameters such as "state" that
remain unchanged before being included in the form. This means that the
HTML page and form became vulnerable to any injection that the attacker
may use in such parameters to be served from the IdP's origin.

Since V4.1.0, the default page has been wired with the Content Security
Policy (CSP) when the configuration property "idp.encoders.cspEnabled"
has been set to "true", which is the default. That prevents reflected
cross-site scripting (XSS) on the IdP's origin. However, markup
injection remains possible, for instance possibly leading the user to
an untrusted web site, possibly with the tokens with the implicit and
hybrid flows.

Recommendations
===============
Update to V4.3.3 or later of the OIDC OP plugin, which is now available.
The IdP's plugin installer can perform this update process.

All previous versions of the OP plugin, including the pre-official
releases (before V3.0), are affected by this vulnerability.

If unable to update, since V4.1.0 the global configuration property
"idp.oauth2.responseModes" or OIDC.SSO profile configuration setting
"responseModes" can be used for specifying the allowed values and
thus excluding form_post mode. Since V3.4.0 the use of signed request
objects may be enforced (see "useRequestObject" and "signRequestObject"
profile configuration settings) to remove attacker ability to modify
the authorization/authentication request parameter values.

Credits
=======
This issue was discovered by the Shibboleth Project team itself.

[1] https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html

URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20261109.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEbRj9Y3CPzKB5tozOAmaRg5NV68oFAmrxvHoACgkQAmaRg5NV
68rUvA//TER2p08f5VnW/JS8NaUqHE4rI6djBKCGyPPK/DxBWLZ8Ct/KyY9MwRux
mrWKL6o/yZStwkpTPbjETdr2pNtYVkoKy5a0OhvPlV03PZKIDG+QQVgw+B+x0yK9
gHNt8aOeUh3UqYKRCNiCPpw6JLqeQQCqV8kytaTJXDD4mmdY3XSLbUjhIUOTidj/
TR5vLxz2/4qGPFIenoeLbp+xtu/lNSoCHKyLY/inMNYhaPJ3sn92EUK4BJ4+Cb0u
hgzPIgw4fX1uOourzeKb8rEVZVw8NoUPQdTqoDZtt4dYFNzbawwBu1Zcn/Z6Qnsy
SW7bTvrhitBQEGRiAaIIlrIPiP+nMlNT6CHmIUtv+GWIkJ5yj+yPFr2zesxZKJAy
QWx9JCbHH2HYAcoDSjPJKmEv1/0O1AdKiKPONAFeSJ4dGpwEkNqaCQudp+g75DyZ
ks9D921JQgE0c1Wc8twrrxd0qlOPORfMas1U83RwqCfbbTSP0m5FBUr8S/TeePhD
jM632S9wszgSV6IAy1LT/VWMmnsSmOUtJDfVKlWnNtaCAfDT88pffBkxDv3pgvgW
tNzPuvmvZGYS873M1hUdxDzvFwrJbpjOAS0s4qz9oyavO85rRIkPVvsurQNoO5SM
WVcBPXZjnUKhCFq302LdyvwQA3Tfv4rljAa5zfW6D5b4vxA3PdI=
=Ztfr
-----END PGP SIGNATURE-----