passport-saml-encrypted through version 0.1.13 performs signature verification only when an optional certificate option is provided; when omitted, the library skips signature validation. This allows an attacker to construct a forged, unsigned SAML response containing arbitrary NameID and attributes, submit it to the assertion consumer service, and obtain an authenticated profile without a valid signature, effectively bypassing authentication and compromising integrity.

The vulnerable component is the krakenjs passport-saml-encrypted package, specifically versions 0.1.13 and earlier. Any project that incorporates this library for SAML assertion handling is susceptible unless a later fix or environmental constraints have been applied.

The CVSS score of 9.3 indicates critical severity and the flaw is remotely exploitable over the network via the SAML assertion consumer service endpoint. While an EPSS score is not available, the lack of protection for unsigned responses creates a high likelihood of exploitation in systems that accept SAML assertions. The high severity warrants immediate remediation.