CVE-2026-89042
CriticalCVSS 9.1Summary
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Risk Assessment
An attacker can obtain an authenticated profile without a valid signature, leading to authentication bypass and unauthorized access.
Recommendation
Enforce mandatory SAML signature verification and upgrade passport-saml-encrypted to a version containing the fix.
Other vulnerabilities in passport-saml-encrypted
Original NVD description (English source)
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.