Is CVE-2025-46573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-46573 being exploited in the wild.

How severe is CVE-2025-46573?

Medium severity, with a CVSS score of 4, published 6 May 2025.

Which products and versions are affected?

passport-wsfed-saml2 (npm) SEMVER:introduced=3.0.5,fixed=4.6.4.

Is there a fix for CVE-2025-46573?

Yes. passport-wsfed-saml2 (npm): upgrade to 4.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-46573 attacked?

It is attacked over the network.

Am I affected by CVE-2025-46573?

Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-46573: Auth0 passport-wsfed-saml2 authentication bypass via SAML attribute smuggling

CVE-2025-46573 · Severity: medium · CVSS 4 · Published 2025-05-06

Passport-wsfed-saml2 is a Node.js library used to add SAML-based single sign-on (SSO) authentication to web applications. An attacker who obtains a valid SAML response from an identity provider can manipulate it by adding extra attributes, allowing them to impersonate any user and bypass authentication controls. This could lead to unauthorized access to sensitive user accounts and data.

Technologies: passport-wsfed-saml2 (npm). Vendors: npm.

Quick answers

Is CVE-2025-46573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-46573 being exploited in the wild.
How severe is CVE-2025-46573?: Medium severity, with a CVSS score of 4, published 6 May 2025.
Which products and versions are affected?: passport-wsfed-saml2 (npm) SEMVER:introduced=3.0.5,fixed=4.6.4.
Is there a fix for CVE-2025-46573?: Yes. passport-wsfed-saml2 (npm): upgrade to 4.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-46573 attacked?: It is attacked over the network.
Am I affected by CVE-2025-46573?: Check whether you run passport-wsfed-saml2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

passport-wsfed-saml2 (npm): upgrade to 4.6.4 or later
```
npm install passport-wsfed-saml2@4.6.4
```

Technical details

This vulnerability is a SAML authentication bypass resulting from improper attribute validation (CWE-287, CWE-290). The root cause is insufficient sanitization of SAML response attributes; an attacker can inject or modify attributes in a validly-signed SAML assertion to impersonate arbitrary users. The attack requires a valid SAML response signed by the identity provider, but no additional authentication or user interaction is needed once this response is obtained. An attacker can achieve full user impersonation and account takeover. The fix is available in version 4.6.4 and later.

Affected products

Auth0 passport-wsfed-saml2 3.0.5 to 4.6.3

Identifiers

CVE-2025-46573
GHSA-8gqj-226h-gm8r

Timeline

2025-05-06: disclosed
2025-05-06: patched: v4.6.4 and later

References

https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-8gqj-226h-gm8r

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.