| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/russellhaering/goxmldsig | < 0.4.2 | 0.4.2 |
An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.
Version 0.4.2 bumps the dependency which should fix the issue.
Please see the advisory in goxmldsig
The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free