crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication

CRITICAL 9.8CVE-2022-41912 · GHSA-j2jp-wvqg-wc2g · GO-2022-1129 · Published 28/11/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
github.com/crewjam/saml Go	`< 0.4.9`	`0.4.9`
saml saml_project	`< 0.4.9`	`0.4.9`

Description

Impact

The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements.

Patches

This issue has been corrected in version 0.4.9.

Credit

This issue was reported by Felix Wilhelm from Google Project Zero.

NVD description

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

References

crewjam/saml security advisory · WEB
prometheus/exporter-toolkit security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-41912 · ADVISORY
crewjam/saml commit aee3fb1 · WEB
crewjam/saml · PACKAGE
crewjam/saml release v0.4.9 · WEB
pkg.go.dev/vuln/GO-2022-1129 · WEB
packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free