CVE-2026-89042

critical

Description

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

References

https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification

https://github.com/krakenjs/passport-saml-encrypted/issues/29

https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321

https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296

https://github.com/krakenjs/passport-saml-encrypted

Details

Source: Mitre, NVD

Published: 2026-09-10

Updated: 2026-09-10

Risk Information

CVSS v2

Base Score: 9.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

Severity: High

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Severity: Critical