~ / search / GHSA-wjmp-wphq-jvqf

GHSA-wjmp-wphq-jvqf

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-46572

Packages

EcosystemPackageAffectedFixed in
npm passport-wsfed-saml2 >= 3.0.5, < 4.6.4 4.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. ### Am I Affected? You are affected by this SAML Signature Wrapping vulnerability if you are using `passport-wsfed-saml2` version 4.6.3 or below, specifically under the following conditions: 1. The service provider is using `passport-wsfed-saml2`, 2. A valid SAML document signed by the Identity Provider can be obtained. ### Fix Upgrade to v4.6.4 or greater.

References

External links from the advisory. They lead to third-party sites.