# CVE-2022-39299: passport-saml signature bypass via multiple root elements

Source: https://junglewise.ai/threats/cve-2022-39299-passport-saml-signature-bypass-via-multiple-root-elements  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-10-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2022-39299 · Severity: low · CVSS 3.1 · Published 2022-10-12

passport-saml is a Node.js library that implements SAML authentication for web applications. An attacker in possession of an arbitrary IDP-signed XML element can bypass SAML authentication entirely, gaining unauthorized access to protected websites. In some configurations, this attack may require no prior valid user credentials.

Technologies: [@node-saml/node-saml (npm)](https://junglewise.ai/threats/technologies/node-saml-node-saml), [node-saml (npm)](https://junglewise.ai/threats/technologies/node-saml), [passport-saml (npm)](https://junglewise.ai/threats/technologies/passport-saml). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2022-39299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-39299 being exploited in the wild.

**How severe is CVE-2022-39299?** Low severity, with a CVSS score of 3.1, published 12 October 2022.

**Which products and versions are affected?** @node-saml/node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5; @node-saml/passport-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.3; node-saml (npm) SEMVER:introduced=0,fixed=4.0.0-beta.5; passport-saml (npm) SEMVER:introduced=0,fixed=3.2.2.

**Is there a fix for CVE-2022-39299?** Yes. @node-saml/node-saml (npm): upgrade to 4.0.0-beta.5 or later; @node-saml/passport-saml (npm): upgrade to 4.0.0-beta.3 or later; node-saml (npm): upgrade to 4.0.0-beta.5 or later; passport-saml (npm): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-39299 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-39299?** Check whether you run @node-saml/node-saml (npm), @node-saml/passport-saml (npm), node-saml (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @node-saml/node-saml (npm): upgrade to 4.0.0-beta.5 or later

  ```sh
  npm install @node-saml/node-saml@4.0.0-beta.5
  ```

- @node-saml/passport-saml (npm): upgrade to 4.0.0-beta.3 or later

  ```sh
  npm install @node-saml/passport-saml@4.0.0-beta.3
  ```

- node-saml (npm): upgrade to 4.0.0-beta.5 or later

  ```sh
  npm install node-saml@4.0.0-beta.5
  ```

- passport-saml (npm): upgrade to 3.2.2 or later

  ```sh
  npm install passport-saml@3.2.2
  ```


## Technical details

The vulnerability is a signature bypass (CWE-347) in SAML authentication libraries caused by improper XML parsing that fails to reject documents with multiple root elements. An attacker can craft a malicious SAML response containing an arbitrary IDP-signed XML element to forge authentication. The attack is network-reachable and requires no user interaction; however, the attacker must obtain or generate a valid IDP-signed XML element. Successful exploitation allows complete bypass of SAML authentication, granting unauthorized access to protected applications. Patches are available in passport-saml 3.2.2 and node-saml 4.0.0-beta.5 or later.

## Affected products

- node-saml passport-saml before 3.2.2
- node-saml node-saml before 4.0.0-beta.5
- node-saml @node-saml/node-saml before 4.0.0-beta.5
- node-saml @node-saml/passport-saml before 4.0.0-beta.3

## Identifiers

- CVE-2022-39299
- GHSA-m974-647v-whv7

## Timeline

- 2022-10-12: disclosed: Advisory published
- 2022-10-12: patched: passport-saml 3.2.2 and node-saml 4.0.0-beta.5 released

## References

- [https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7](https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7)

## Related threats

- [Node-SAML SAML assertion signature verification bypass](https://junglewise.ai/threats/cve-2025-54419-node-saml-saml-assertion-signature-verification-bypass)
- [Node-SAML SAML authentication bypass via assertion modification](https://junglewise.ai/threats/cve-2025-54369-node-saml-saml-authentication-bypass-via-assertion-modification)
- [node-saml/node-saml timestamp validation bypass in validatePostRequestAsync](https://junglewise.ai/threats/cve-2023-40178-node-saml-node-saml-timestamp-validation-bypass-in)
- [node-saml signature bypass via multiple root elements](https://junglewise.ai/threats/cve-2022-39300-node-saml-signature-bypass-via-multiple-root-elements)
- [passport-saml unlimited transforms denial of service](https://junglewise.ai/threats/cve-2021-39171-passport-saml-unlimited-transforms-denial-of-service)