GHSA-m837-g268-mmv7

Suggest an improvement
Source
https://github.com/advisories/GHSA-m837-g268-mmv7
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-m837-g268-mmv7/GHSA-m837-g268-mmv7.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-m837-g268-mmv7
Aliases
  • CVE-2025-54369
Related
Published
2025-07-25T14:08:50Z
Modified
2025-07-25T15:59:33.608303Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Node-SAML SAML Authentication Bypass
Details

Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature.

This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username.

To conduct the attack an attacker would need a validly signed document from the identity provider (IdP).

In fixing this we upgraded xml-crypto to v6.1.2 and made sure to process the SAML assertions from only verified/authenticated contents. This will prevent future variants from coming up.

Database specific 
{
    "github_reviewed_at": "2025-07-25T14:08:50Z",
    "nvd_published_at": "2025-07-24T23:15:26Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-287",
        "CWE-347"
    ],
    "severity": "CRITICAL"
}
References

Affected packages

npm / node-saml

Package

Name
node-saml
View open source insights on deps.dev
Purl
pkg:npm/node-saml

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.1.2

npm / @node-saml/node-saml

Package

Name
@node-saml/node-saml
View open source insights on deps.dev
Purl
pkg:npm/%40node-saml/node-saml

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.1.0

Database specific 

{
    "last_known_affected_version_range": "<= 5.0.1"
}