# Auth0 passport-wsfed-saml2 authentication bypass

Source: https://junglewise.ai/threats/auth0-passport-wsfed-saml2-authentication-bypass-3bf0a7d5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-12-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3 · Published 2017-12-28

The Auth0 passport-wsfed-saml2 library is used for SAML-based authentication in web applications. A vulnerability allows an attacker to impersonate other users and escalate privileges by forging SAML responses when the identity provider fails to sign the complete response. This could enable account takeover and unauthorized access to protected resources.

Technologies: [passport-wsfed-saml2 (npm)](https://junglewise.ai/threats/technologies/passport-wsfed-saml2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3, published 28 December 2017.

**Which products and versions are affected?** passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=3.0.5.

**Is there a fix for This vulnerability?** Yes. passport-wsfed-saml2 (npm): upgrade to 3.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- passport-wsfed-saml2 (npm): upgrade to 3.0.5 or later

  ```sh
  npm install passport-wsfed-saml2@3.0.5
  ```


## Technical details

The vulnerability (CWE-290: Improper Validation of Cryptographic Signature) occurs in passport-wsfed-saml2 versions before 3.0.5 when processing SAML responses that are not fully signed by the identity provider. An attacker can forge or modify SAML assertions, including only-asserted-signed responses, to impersonate legitimate users without valid credentials. The attack requires no authentication or user interaction and is network-accessible. The fix is available in version 3.0.5 and later.

## Affected products

- Auth0 passport-wsfed-saml2 < 3.0.5

## Timeline

- 2017-12-28: disclosed
- 2023-06-21: other: Advisory withdrawn as duplicate of GHSA-77fw-rf4v-vfp9

## References

- [https://auth0.com/docs/security/bulletins/cve-2017-16897](https://auth0.com/docs/security/bulletins/cve-2017-16897)

## Related threats

- [Auth0 passport-wsfed-saml2 authentication bypass via SAML attribute smuggling](https://junglewise.ai/threats/cve-2025-46573-auth0-passport-wsfed-saml2-authentication-bypass-via-saml)
- [Passport-wsfed-saml2 SAML authentication bypass via signature wrapping](https://junglewise.ai/threats/cve-2025-46572-passport-wsfed-saml2-saml-authentication-bypass-via-signature)
- [Auth0 passport-wsfed-saml2 SAML signature relocation bypass](https://junglewise.ai/threats/auth0-passport-wsfed-saml2-saml-signature-relocation-bypass-9de6c222)
- [passport-wsfed-saml2 signature bypass in SAML2 token validation](https://junglewise.ai/threats/cve-2017-16897-passport-wsfed-saml2-signature-bypass-in-saml2-token-validation)
- [passport-wsfed-saml2 signature bypass in WSFed authentication](https://junglewise.ai/threats/cve-2022-23505-passport-wsfed-saml2-signature-bypass-in-wsfed-authentication)