passport-saml-encrypted CVE-2026-89043

Exploitation requires the attacker to possess at least one validly signed SAML message issued by the trusted IdP for the target SP (this is the CVSS 4.0 AT:P attack requirement) - for example a legitimate low-privilege assertion, a replayed capture, or a valid message from any account. Given that prerequisite, no authentication to the SP (PR:N) and no user interaction (UI:N) are needed, and it works against default configurations of passport-saml-encrypted through 0.1.13 because the verify-vs-extract XPath mismatch is inherent to the library, not a toggle. Limiting factors: the required signed sample, and any deployment that additionally enforces single-assertion or response-level signature binding would blunt the prepending technique.

This is a genuine high-severity authentication/integrity issue, not a CVSS-inflation case: the CVSS 4.0 base score of 9.1 reflects network vector, low complexity, no privileges, no user interaction, and high confidentiality and integrity impact (VC:H/VI:H), with VA:N confirming there is no availability effect. The key discriminator is AT:P (Attack Requirements: Present) - the attacker must first obtain at least one validly signed SAML message from the target IdP, which is the practical gating condition and lowers the realism somewhat versus a truly zero-prerequisite bug. No EPSS score, KEV entry, or POC was supplied, so exploitation likelihood signals are absent; the risk here rests on the well-understood, reproducible nature of XSW attacks rather than on observed exploitation. Note the input Tags include 'Denial Of Service', which conflicts with the vector (VA:N, no availability impact) - the real impact is credential/identity forgery - and 'Jwt Attack', which is inaccurate since this is a SAML XML-signature attack, not a JWT one.

An attacker who has captured or been legitimately issued one valid signed SAML assertion (for example, a low-privilege account or an intercepted assertion) edits the SAML response to prepend a second, unsigned <Assertion> naming an administrator's identity. The SP's signature check still validates against the original genuine assertion, but the identity-extraction XPath reads the forged prepended assertion, logging the attacker in as the victim/admin. Because the attack is fully server-reachable over the network with no user interaction, it can be scripted once a single signed sample is obtained; no public POC is currently identified.