| Package | Affected versions | Patched versions |
|---|---|---|
| passport-saml | = 4.0.0< 3.2.2 | 3.2.2 |
| @node-saml/node-saml | < 4.0.0-beta.5 | 4.0.0-beta.5 |
| @node-saml/passport-saml | < 4.0.0-beta.3 | 4.0.0-beta.3 |
| node-saml | < 4.0.0-beta.5 | 4.0.0-beta.5 |
| passport-saml | < 3.2.2 | 3.2.2 |
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5.
Disable SAML authentication.
Are there any links users can visit to find out more?
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free