Executive brief
Passport-wsfed-saml2 is a Node.js authentication library that validates SAML identity provider responses for single sign-on. A flaw in signature validation allows attackers to forge SAML responses and impersonate any user without knowing their password, enabling unauthorized account access and potential data theft or privilege escalation.
Technical details
This vulnerability is a SAML Signature Wrapping attack (CWE-287, CWE-347) in the SAML response validation logic. An attacker who can obtain a valid SAML document signed by the configured identity provider can manipulate the XML structure to bypass signature verification, allowing impersonation of arbitrary users. The attack requires network access to the service provider using the library and a valid signed SAML object; no authentication or user interaction is required. An attacker can gain unauthorized access to user accounts and assume their identity. The vulnerability affects passport-wsfed-saml2 versions 3.0.5 through 4.6.3; patched in version 4.6.4 or later.
Affected products
- Auth0 passport-wsfed-saml2 3.0.5 through 4.6.3
Timeline
- 2025-05-06: disclosed: GHSA-wjmp-wphq-jvqf published