CVE-2026-89042
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Faiblesse
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Références
- https://github.com/krakenjs/passport-saml-encrypted
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
- https://github.com/krakenjs/passport-saml-encrypted/issues/29
- https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification
Trouvez la faille avant un attaquant.
Connectez-vous avec GitHub et lancez votre premier audit en moins d'une minute. L'offre gratuite ne nécessite aucune carte bancaire.