CVE-2026-89043: passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs any validly signed SAML message. They can prepend a forged, unsigned assertion so that signature validation succeeds for the original assertion while identity extraction uses the forged assertion.
Which deployments are affected?
Deployments using passport-saml-encrypted version 0.1.13 or earlier are affected. The supplied data does not identify any configuration prerequisite or mitigation through configuration changes.
What is the likely impact if exploitation succeeds?
An attacker may be accepted as the identity specified in the forged assertion. The vulnerability is rated high and has high confidentiality and integrity impact in the provided vector.