CVE-2026-89043
The vulnerability is an XML signature wrapping flaw in passport-saml-encrypted 0.1.13 and earlier. It lets an attacker insert a forged SAML assertion that is accepted as the authenticated identity while the original signed assertion remains valid. This can allow an attacker to impersonate users without needing to break the signature.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users of the passport-saml-encrypted library version 0.1.13 or earlier, typically developers integrating SAML authentication into Node.js applications.
Real-world impact
An attacker who can send a signed SAML message can prepend a malicious assertion that the library will accept as the authenticated user. This could let the attacker gain unauthorized access to protected resources, impersonate legitimate users, or bypass authentication controls.
Why this severity
The CVSS score of 9.1 reflects the high impact on confidentiality and integrity: the flaw allows attackers to forge identities (high confidentiality impact) and bypass authentication (high integrity impact) with no authentication or user interaction required. The attack vector is network-based, with low complexity and no privileges needed.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources