CVE-2025-54369
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
Risk Assessment
An attacker could alter identity or privileges in a SAML assertion, potentially leading to unauthorized application access.
Recommendation
Update Node-SAML to version 5.1.0 or later.
Other vulnerabilities in Node-SAML
Original NVD description (English source)
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS