Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@node-saml/passport-saml

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.1npmAmendedPublished

    Signature bypass via multiple root elements

    CVE-2022-39299 · GHSA-m974-647v-whv7

    Affected
    • npm @node-saml/passport-saml < 4.0.0-beta.3
    Fixed in
    4.0.0-beta.3· Vendor fix available
    Issue
    Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Patches Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5. Workarounds Disable SAML authentication. References Are there any links users can visit to find out more? For more information If you have any questions or comments about this advisory: Open a discussion in the node-saml repo Credits Felix Wilhelm of Google Project Zero

    Recommended action: Upgrade to 4.0.0-beta.3 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →