CVE-2026-89043
passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
CVSS 4.0 9.1 CRITICALCVSS 3.1 7.4 HIGHCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-89043
Publishedpassport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-89043 · CVE overview and exploitation status
cve-program · CVE-2026-89043
- https://github.com/krakenjs/passport-saml-encrypted/issues/30
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256
- https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328
- https://github.com/krakenjs/passport-saml-encrypted
- https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending
Related changes
Linked by CVE identifierNo related changes are available here.