CVE-2026-89042

passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

Published Sep 10, 2026 CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Description

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

Analysis

Technical impact

passport-saml-encrypted through version 0.1.13 performs signature verification only when an optional certificate option is provided; when omitted, the library skips signature validation. This allows an attacker to construct a forged, unsigned SAML response containing arbitrary NameID and attributes, submit it to the assertion consumer service, and obtain an authenticated profile without a valid signature, effectively bypassing authentication and compromising integrity.

Affected Systems

The vulnerable component is the krakenjs passport-saml-encrypted package, specifically versions 0.1.13 and earlier. Any project that incorporates this library for SAML assertion handling is susceptible unless a later fix or environmental constraints have been applied.

Risk and Exploitability

The CVSS score of 9.3 indicates critical severity and the flaw is remotely exploitable over the network via the SAML assertion consumer service endpoint. While an EPSS score is not available, the lack of protection for unsigned responses creates a high likelihood of exploitation in systems that accept SAML assertions. The high severity warrants immediate remediation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

krakenjs

passport-saml-encrypted

unaffected

Version	Status	Constraints
`0`	affected	≤ 0.1.13

No data.

Vendor Product Versions

Krakenjs

Passport-saml-encrypted

Version	Status	Scheme	Platform
`[0,0.1.13]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to passport-saml-encrypted version 0.1.14 or later, which enforces signature verification regardless of certificate configuration.
Configure the SAML service provider to reject unsigned assertions by enabling strict signature validation in its settings.
As a temporary measure, modify local code or apply a patch that forces signature verification even when the optional cert option is omitted.

Generated by OpenCVE AI on September 11, 2026 at 00:08 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.386% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/krakenjs/passport-saml-encrypted
https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
https://github.com/krakenjs/passport-saml-encrypted/issues/29
https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification

History

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Krakenjs Krakenjs passport-saml-encrypted
Vendors & Products		Krakenjs Krakenjs passport-saml-encrypted

Sep 11, 2026 11:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 10, 2026 5:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Title		passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
Weaknesses		CWE-347
References		https://github.com/krakenjs/passport-saml-encrypted https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296 https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321 https://github.com/krakenjs/passport-saml-encrypted/issues/29 https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`