CVE-2025-54369: Node-SAML SAML authentication bypass via assertion modification

CVE-2025-54369 · Severity: medium · CVSS 4 · Published 2025-07-25

Node-SAML is a library that handles SAML-based single sign-on (SSO) authentication for Node.js applications. The library fails to validate the integrity of SAML assertions from unsigned portions of the IdP response, allowing an attacker with a valid signed assertion to modify authentication details such as usernames. This bypasses authentication controls and can lead to unauthorized account access across applications relying on Node-SAML for identity verification.

Technologies: @node-saml/node-saml (npm), node-saml (npm). Vendors: npm.

Quick answers

Is CVE-2025-54369 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-54369 being exploited in the wild.
How severe is CVE-2025-54369?
Medium severity, with a CVSS score of 4, published 25 July 2025.
Which products and versions are affected?
@node-saml/node-saml (npm) SEMVER:introduced=0,fixed=5.1.0; node-saml (npm) SEMVER:introduced=0,last_affected=3.1.2.
Is there a fix for CVE-2025-54369?
Yes. @node-saml/node-saml (npm): upgrade to 5.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54369 attacked?
It is attacked over the network.
Am I affected by CVE-2025-54369?
Check whether you run @node-saml/node-saml (npm) or node-saml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @node-saml/node-saml (npm): upgrade to 5.1.0 or later
    npm install @node-saml/node-saml@5.1.0

Technical details

Node-SAML loads SAML assertions from the unsigned portions of the original response document, while signature verification is performed on different XML structures. This mismatch allows an attacker to modify assertion contents (e.g., remove characters from usernames) while preserving a valid signature on the original signed elements. The attack requires a validly signed SAML response from a legitimate identity provider, but the attacker can then tamper with the unsigned assertion data before the application processes it. The vulnerability was fixed in versions 5.1.0 and later by upgrading xml-crypto to v6.1.2 and ensuring assertions are processed only from verified/authenticated contents (CWE-287, CWE-347, CWE-87).

Affected products

  • Node-SAML node-saml <= 5.0.1
  • Node-SAML @node-saml/node-saml <= 5.0.1

Identifiers

  • CVE-2025-54369
  • GHSA-m837-g268-mmv7

Timeline

  • 2025-07-24: disclosed: Advisory published
  • 2025-07-24: patched: Fixed in versions 5.1.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.