GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Published Nov 5, 2026

Updated

github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:

1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional <saml:Issuer> element causes a nil-pointer dereference panic after signature verification.

2. Subject uses the bare XML struct tag xml:"NameID", which matches <NameID> elements in any XML namespace. When a signed assertion omits <saml:NameID> and includes a <NameID> element in a foreign namespace inside <saml:Subject>, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.

Affected Software

1 affected component

go/github.com/crewjam/saml*

Event History

Nov 5, 2026

Advisory Published

via OSV·10:55 PM

Data Sourced

via OSV·10:55 PM

DescriptionAffected Software

Frequently Asked Questions

Who can trigger the nil-pointer panic?

An attacker who can supply a signed SAML assertion that passes signature verification can trigger it by omitting the optional saml:Issuer element. The panic occurs when ExpectedIDPEntityID is non-empty.

What is required to spoof Subject.NameID?

The attacker needs a signed assertion with no saml:NameID and a NameID element from a foreign XML namespace inside saml:Subject. The XML decoder can then populate Subject.NameID from that foreign-namespace element, allowing the authenticated principal to control Subject.NameID.Value.

Are all deployments affected by the denial-of-service condition?

The nil-pointer panic is conditional on ExpectedIDPEntityID being non-empty. The provided information does not state whether that setting is enabled by default.

How can I identify assertions associated with these issues?

For the panic condition, inspect signed assertions for a missing saml:Issuer when ExpectedIDPEntityID is configured. For the identity-spoofing condition, inspect saml:Subject for a missing saml:NameID together with a NameID element in another XML namespace.

GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Affected Software

Event History

Frequently Asked Questions

Who can trigger the nil-pointer panic?

What is required to spoof Subject.NameID?

Are all deployments affected by the denial-of-service condition?

How can I identify assertions associated with these issues?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the nil-pointer panic?

What is required to spoof Subject.NameID?

Are all deployments affected by the denial-of-service condition?

How can I identify assertions associated with these issues?