node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Node Saml Project |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-7029 | node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround. |
 Github GHSA |
GHSA-5p8w-2mvw-38pv | Signature bypass via multiple root elements |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-04-23T16:50:20.803Z
Reserved: 2022-09-02T00:00:00.000Z
Link: CVE-2022-39300
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-10-13T22:15:10.300
Modified: 2024-11-21T07:17:59.237
Link: CVE-2022-39300
Redhat
No data.
OpenCVE Enrichment
No data.