Passport Saml Encrypted
Monthly
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
Authentication bypass in the passport-saml-encrypted npm library (krakenjs) through version 0.1.13 lets remote unauthenticated attackers forge SAML assertions. Because signature verification is gated on the optional 'cert' configuration option, deployments that omit it accept unsigned SAML responses, allowing an attacker to POST a forged response with an arbitrary NameID and attributes to the assertion consumer service (ACS) endpoint and be logged in as any user. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV, though the flaw is trivially exploitable once discovered.
Authentication bypass in the passport-saml-encrypted Node.js/Passport SAML strategy (versions through 0.1.13) lets a remote attacker impersonate arbitrary users via classic XML Signature Wrapping (XSW). Because signature verification and assertion extraction perform independent, uncorrelated XPath lookups, an attacker who possesses any single validly signed SAML message can prepend a forged, unsigned assertion that the application accepts as the authenticated identity while the genuine signature still validates against the untouched original assertion. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; reported by VulnCheck.
Authentication bypass in the passport-saml-encrypted npm library (krakenjs) through version 0.1.13 lets remote unauthenticated attackers forge SAML assertions. Because signature verification is gated on the optional 'cert' configuration option, deployments that omit it accept unsigned SAML responses, allowing an attacker to POST a forged response with an arbitrary NameID and attributes to the assertion consumer service (ACS) endpoint and be logged in as any user. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV, though the flaw is trivially exploitable once discovered.