CVE-2026-89042: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to authentication bypass?
Deployments using passport-saml-encrypted through version 0.1.13 are exposed when the SAML certificate option is not configured, because signature verification is then conditional rather than enforced.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without privileges or user interaction by submitting a forged, unsigned SAML response to the application's assertion consumer service endpoint. The forged response can contain an arbitrary NameID and attributes.
What is the effect of a successful exploit?
A successful attacker can receive an authenticated profile without providing a valid SAML signature. This can allow impersonation of identities represented by attacker-controlled NameID and attribute values.
What can be done while a package update is unavailable?
Configure the SAML certificate option so that signature verification is performed, and ensure the assertion consumer service endpoint does not accept unsigned SAML responses.