Executive brief
Node-SAML is a library that handles SAML-based single sign-on (SSO) authentication for Node.js applications. The library fails to validate the integrity of SAML assertions from unsigned portions of the IdP response, allowing an attacker with a valid signed assertion to modify authentication details such as usernames. This bypasses authentication controls and can lead to unauthorized account access across applications relying on Node-SAML for identity verification.
Technical details
Node-SAML loads SAML assertions from the unsigned portions of the original response document, while signature verification is performed on different XML structures. This mismatch allows an attacker to modify assertion contents (e.g., remove characters from usernames) while preserving a valid signature on the original signed elements. The attack requires a validly signed SAML response from a legitimate identity provider, but the attacker can then tamper with the unsigned assertion data before the application processes it. The vulnerability was fixed in versions 5.1.0 and later by upgrading xml-crypto to v6.1.2 and ensuring assertions are processed only from verified/authenticated contents (CWE-287, CWE-347, CWE-87).
Affected products
- Node-SAML node-saml <= 5.0.1
- Node-SAML @node-saml/node-saml <= 5.0.1
Timeline
- 2025-07-24: disclosed: Advisory published
- 2025-07-24: patched: Fixed in versions 5.1.0 and later