LightSAML, a library for handling SAML 2.0 messages, misinterprets which XML element a digital signature covers. When deserializing SAML Responses, the library validates a signature that may refer to a different node than the assertion it later processes. An attacker can embed a genuine signature into an earlier, signature‑striped part of the response and then inject a forged assertion containing the same ID and signature. As a result, the library believes the data is signed while in reality it accepts unsigned, attacker‑controlled Subject, Conditions, and Attribute values, enabling authentication bypass or privilege escalation.

The vulnerability affects all installations of litesaml:lightsaml older than versions 4.7.1 and 5.0.1. Systems that rely on this library to validate SAML tokens in web or service applications are impacted; no other vendors are listed.

The CVSS score of 8.1 marks this flaw as high severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not currently exploited in the wild. The most likely attack vector is via network channels that deliver SAML responses from an IdP to a relying party—an inferred scenario based on the SAML protocol flow. If an attacker can supply crafted responses, they can bypass authentication checks without tampering with the signature verification process.