CVE-2026-89043
HighCVSS 7.4Summary
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity.
Risk Assessment
An attacker can impersonate any user, gaining unauthorized access to the application and its data.
Recommendation
Upgrade passport-saml-encrypted to a version newer than 0.1.13 when available. Until then, consider an alternative SAML library or additional assertion validation.
Other vulnerabilities in passport-saml-encrypted
Original NVD description (English source)
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.