CVE-2025-46572: Passport-wsfed-saml2 SAML authentication bypass via signature wrapping

CVE-2025-46572 · Severity: medium · CVSS 4 · Published 2025-05-06

Passport-wsfed-saml2 is a Node.js authentication library that validates SAML identity provider responses for single sign-on. A flaw in signature validation allows attackers to forge SAML responses and impersonate any user without knowing their password, enabling unauthorized account access and potential data theft or privilege escalation.

Technologies: passport-wsfed-saml2 (npm). Vendors: npm.

Quick answers

Is CVE-2025-46572 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-46572 being exploited in the wild.
How severe is CVE-2025-46572?
Medium severity, with a CVSS score of 4, published 6 May 2025.
Which products and versions are affected?
passport-wsfed-saml2 (npm) SEMVER:introduced=3.0.5,fixed=4.6.4.
Is there a fix for CVE-2025-46572?
Yes. passport-wsfed-saml2 (npm): upgrade to 4.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-46572 attacked?
It is attacked over the network.
Am I affected by CVE-2025-46572?
Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • passport-wsfed-saml2 (npm): upgrade to 4.6.4 or later
    npm install passport-wsfed-saml2@4.6.4

Technical details

This vulnerability is a SAML Signature Wrapping attack (CWE-287, CWE-347) in the SAML response validation logic. An attacker who can obtain a valid SAML document signed by the configured identity provider can manipulate the XML structure to bypass signature verification, allowing impersonation of arbitrary users. The attack requires network access to the service provider using the library and a valid signed SAML object; no authentication or user interaction is required. An attacker can gain unauthorized access to user accounts and assume their identity. The vulnerability affects passport-wsfed-saml2 versions 3.0.5 through 4.6.3; patched in version 4.6.4 or later.

Affected products

  • Auth0 passport-wsfed-saml2 3.0.5 through 4.6.3

Identifiers

  • CVE-2025-46572
  • GHSA-wjmp-wphq-jvqf

Timeline

  • 2025-05-06: disclosed: GHSA-wjmp-wphq-jvqf published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.