EUVD-2026-75631
GHSA-vw3m-3x7w-24g8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, no interaction POST to the ACS forges any identity, giving full session confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
AnalysisAI
Authentication bypass in the passport-saml-encrypted npm library (krakenjs) through version 0.1.13 lets remote unauthenticated attackers forge SAML assertions. Because signature verification is gated on the optional 'cert' configuration option, deployments that omit it accept unsigned SAML responses, allowing an attacker to POST a forged response with an arbitrary NameID and attributes to the assertion consumer service (ACS) endpoint and be logged in as any user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the passport-saml-encrypted strategy be initialized WITHOUT the optional 'cert' (IdP signing certificate) option - that missing/optional configuration is exactly what disables signature verification and is the concrete precondition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue for any deployment using the library without a configured 'cert'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version was identified at time of analysis (the references point to a project issue and vulnerable source lines, not a tagged fix release), so treat the primary mitigation as configuration hardening: explicitly set the 'cert' option to the trusted IdP's signing certificate in every use of the strategy so that signature verification is always enforced, and reject responses that are not signed by that certificate. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all production applications and dependencies for passport-saml-encrypted ≤0.1.13 usage. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Passport Saml Encrypted
View allShare
External POC / Exploit Code
Leaving vuln.today