| Package | Affected versions | Patched versions |
|---|---|---|
| passport-wsfed-saml2 | ≤ 4.6.2 | |
| passport-wsfed-saml2 | < 4.6.3 | 4.6.3 |
A remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
You are affected if you are using WSFed protocol with the passport-wsfed-saml2 library versions < 4.6.3. SAML2 protocol is not affected.
Upgrade the library to version 4.6.3.
No, the fix will not impact your users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free