CVE-2026-89042 | BDVDB-2026-371513 Detail
krakenjspassport-saml-encrypted
Description#
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact none. Attack vector: network.
Weaknesses#
- CWE-347 Improper Verification of Cryptographic Signature
References#
- https://github.com/krakenjs/passport-saml-encrypted/issues/29
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
- https://github.com/krakenjs/passport-saml-encrypted
- https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.