# Auth0 passport-wsfed-saml2 SAML signature relocation bypass

Source: https://junglewise.ai/threats/auth0-passport-wsfed-saml2-saml-signature-relocation-bypass-9de6c222  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-06-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2023-06-21

Passport-wsfed-saml2 is a Node.js library that handles SAML authentication for web applications. An authenticated attacker can manipulate the location of the signature element in SAML assertions, allowing them to alter critical fields (such as group membership) while the signature remains valid. This could lead to privilege escalation or unauthorized access by circumventing intended security controls.

Technologies: [passport-wsfed-saml2 (npm)](https://junglewise.ai/threats/technologies/passport-wsfed-saml2). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 21 June 2023.

**Which products and versions are affected?** passport-wsfed-saml2 (npm) SEMVER:introduced=0,fixed=3.0.10.

**Is there a fix for This vulnerability?** Yes. passport-wsfed-saml2 (npm): upgrade to 3.0.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- passport-wsfed-saml2 (npm): upgrade to 3.0.10 or later

  ```sh
  npm install passport-wsfed-saml2@3.0.10
  ```


## Technical details

The vulnerability is a signature relocation attack (CWE-347: Improper Verification of Cryptographic Signature) in SAML signature validation. The root cause is that the validation logic does not enforce that the Signature tag must appear in the correct position within the Assertion tag, allowing an attacker to move the signature element while maintaining cryptographic validity. An authenticated attacker can exploit this by crafting a malicious SAML response that relocates the signature, enabling field corruption—specifically removing group attributes or modifying other assertion data. Attack preconditions include authentication to the SAML identity provider and the ability to craft and send a modified SAML assertion. The fix, released in version 3.0.10, enforces proper signature location validation. Patches are available, and no active exploitation in the wild has been reported.

## Affected products

- Auth0 passport-wsfed-saml2 < 3.0.10

## Timeline

- 2023-06-21: disclosed

## References

- [https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-5wrg-8fxp-cx9r](https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-5wrg-8fxp-cx9r)
- [https://github.com/auth0/passport-wsfed-saml2/pull/79](https://github.com/auth0/passport-wsfed-saml2/pull/79)
- [https://github.com/auth0/passport-wsfed-saml2/commit/f75211d42d2586a0d24a9da29ba8590e42363500](https://github.com/auth0/passport-wsfed-saml2/commit/f75211d42d2586a0d24a9da29ba8590e42363500)
- [https://github.com/auth0/passport-wsfed-saml2](https://github.com/auth0/passport-wsfed-saml2)

## Related threats

- [Auth0 passport-wsfed-saml2 authentication bypass via SAML attribute smuggling](https://junglewise.ai/threats/cve-2025-46573-auth0-passport-wsfed-saml2-authentication-bypass-via-saml)
- [Passport-wsfed-saml2 SAML authentication bypass via signature wrapping](https://junglewise.ai/threats/cve-2025-46572-passport-wsfed-saml2-saml-authentication-bypass-via-signature)
- [passport-wsfed-saml2 signature bypass in SAML2 token validation](https://junglewise.ai/threats/cve-2017-16897-passport-wsfed-saml2-signature-bypass-in-saml2-token-validation)
- [passport-wsfed-saml2 signature bypass in WSFed authentication](https://junglewise.ai/threats/cve-2022-23505-passport-wsfed-saml2-signature-bypass-in-wsfed-authentication)
- [Auth0 passport-wsfed-saml2 authentication bypass](https://junglewise.ai/threats/auth0-passport-wsfed-saml2-authentication-bypass-3bf0a7d5)