passport-wsfed-saml2 Signature Bypass vulnerability
Information
Please note that this is not a new disclosure, and is previously reported in our SECURITY-NOTICE.md which we removed in favor of github advisory.
Overview
A vulnerability was found in the validation of a SAML signature. The validation doesn't ensure that the "Signature" tag is at the proper location inside an "Assertion" tag. This leads to a signature relocation attack where the attacker can corrupt one field of data while maintaining the signature valid. This could allow an authenticated attacker to "remove" one group from the assertion or corrupt another field of an assertion.
Am I affected?
You are affected if you are using the passport-wsfed-saml2 library to version < 3.0.10
How do I fix it?
You may fix this issue by upgrading passport-wsfed-saml2 library to version 3.0.10 or above.
Will the fix impact my users?
This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | passport-wsfed-saml2 | < 3.0.10 | 3.0.10 |
Referencias
- Debilidad (CWE)
-- Plataforma
- npm
- Paquete
passport-wsfed-saml2- Publicada
- 21.06.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-5wrg-8fxp-cx9r - CC BY 4.0
Historial de vulnerabilidades: passport-wsfed-saml2
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 5
- Primera → última
- 12.2022 05.2025
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 1
- Alta 3
- Media 1
Divulgaciones por año
- 2022: 1
- 2023: 2
- 2024: 0
- 2025: 2
- 2026: 0
-
passport-wsfed-saml2 Signature Bypass vulnerability esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.