EUVD-2026-75631
GHSA-vw3m-3x7w-24g8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover SAML SSO ACS endpoint
-
DeliveryCraft unsigned SAML response with attacker NameID
-
ExploitPOST forged response to ACS
-
ExecutionLibrary skips signature check (no cert)
-
ImpactReceive authenticated session as arbitrary user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires that the passport-saml-encrypted strategy be initialized WITHOUT the optional 'cert' (IdP signing certificate) option - that missing/optional configuration is exactly what disables signature verification and is the concrete precondition. The attacker must be able to reach the application's SAML assertion consumer service (ACS) endpoint over the network and know or guess a valid target NameID/attribute schema. No authentication, credentials, user interaction, or non-network position is needed. The primary limiting factor is that deployments which DO configure 'cert' are not vulnerable, and the affected package is a niche npm library, bounding real-world exposure. |
| Impact | This is a genuine high-priority issue for any deployment using the library without a configured 'cert'. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:H) score of 9.3 is consistent with the description: fully remote, no authentication, no user interaction, and no special attack requirements, yielding a complete confidentiality and integrity compromise of the authenticated session. No EPSS score, KEV listing, or public POC was provided, so there is no evidence of active exploitation yet - but the exploit primitive (POST a hand-crafted unsigned SAML response) requires no memory-corruption skill and is well within reach of any attacker who understands SAML, so any team running this in an SSO path should treat it as urgent rather than waiting for exploitation signals. The main risk-limiting factor is deployment scope: this is an obscure fork/variant, and only instances that omit the 'cert' option are vulnerable. Note the input tags 'Denial Of Service' and 'Jwt Attack' are both wrong - the impact is authentication bypass (confidentiality/integrity), and the technology is SAML/XML-DSig, not JWT. |
| Exploit ScenarioDerived | An attacker enumerates an application's SAML SSO login and locates its assertion consumer service (ACS) URL. They craft an unsigned SAML response asserting NameID 'admin@victim.com' with elevated attributes and POST it directly to the ACS endpoint; because the deployment did not configure the IdP 'cert', the library skips signature validation and issues an authenticated session for that identity. No POC is published, but the attack requires only a scripted HTTP POST and basic SAML knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 10, 2026
Authentication bypass in the passport-saml-encrypted npm library (krakenjs) through version 0.1.13 lets remote unauthenticated attackers forge SAML assertions. Because signature verification is gated on the optional 'cert' configuration option, deployments that omit it accept unsigned SAML responses, allowing an attacker to POST a forged response with an arbitrary NameID and attributes to the assertion consumer service (ACS) endpoint and be logged in as any user. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV, though the flaw is trivially exploitable once discovered.
RemediationAI
No vendor-released patched version was identified at time of analysis (the references point to a project issue and vulnerable source lines, not a tagged fix release), so treat the primary mitigation as configuration hardening: explicitly set the 'cert' option to the trusted IdP's signing certificate in every use of the strategy so that signature verification is always enforced, and reject responses that are not signed by that certificate. As a code-level control, audit initialization to ensure the library never runs without 'cert', and consider migrating to a maintained SAML library (e.g. @node-saml/passport-saml) that fails closed on missing certificates. Compensating controls include restricting the ACS endpoint to expected network paths and enabling WAF/log monitoring for SAML responses lacking a Signature element; these reduce but do not eliminate risk since a valid SSO request path must remain reachable. Track https://github.com/krakenjs/passport-saml-encrypted/issues/29 and the VulnCheck advisory for a released fix version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
passport-saml-encrypted is a Passport.js strategy for SAML 2.0 single sign-on with encrypted assertion support, distributed via npm under the krakenjs org (cpe:2.3:a:krakenjs:passport-saml-encrypted). The root cause is CWE-347 (Improper Verification of Cryptographic Signature): in lib/saml.js (referenced around lines 296 and 321 of the v0.1.13 tag), the code only enforces XML-DSig validation of the SAML response/assertion when a 'cert' (IdP public certificate) option is supplied. SAML's entire trust model depends on the Service Provider cryptographically validating that an assertion was signed by the trusted Identity Provider; making that check conditional means a Relying Party that has not explicitly configured the IdP certificate will treat any well-formed, unsigned assertion as authentic.
Know when Passport Saml Encrypted gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Remote, unauthenticated, no interaction POST to the ACS forges any identity, giving full session confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Executive ViewAI
The passport-saml-encrypted npm package (krakenjs, ≤0.1.13) contains a critical authentication bypass that allows unauthenticated attackers to forge SAML assertions and assume the identity of any user. Organizations relying on this library are at immediate risk of account compromise and unauthorized system access if their deployments omit the optional certificate configuration.
No vendor-released patch identified at time of analysis. Enforce the 'cert' configuration parameter in all SAML deployments and validate that signature verification is active. Implement application-layer SAML response validation as a secondary control independent of the library. Monitor authentication logs for successful logins with unusual attributes or NameID values. Network segmentation limiting access to ACS endpoints and IP allowlisting for identity providers provide additional defense in depth. Consider temporary SAML service disablement pending patch availability or migration to alternative libraries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB