CVE-2025-54419: Node-SAML SAML assertion signature verification bypass

CVE-2025-54419 · Severity: low · CVSS 3.1 · Published 2025-07-28

Node-SAML is a popular Node.js library that implements SAML single sign-on authentication. The library has a critical flaw where it extracts user authentication details from unverified portions of SAML responses, allowing attackers to modify usernames and other attributes even when the overall SAML response is cryptographically signed by a legitimate identity provider. An attacker with a valid signed response could alter their username or other claims to gain unauthorized access. This is fixed in version 5.1.0.

Technologies: @node-saml/node-saml (npm), passport-saml (npm). Vendors: npm.

Quick answers

Is CVE-2025-54419 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-54419 being exploited in the wild.
How severe is CVE-2025-54419?
Low severity, with a CVSS score of 3.1, published 28 July 2025.
Which products and versions are affected?
@node-saml/node-saml (npm) SEMVER:introduced=0,fixed=5.1.0; @node-saml/passport-saml (npm) SEMVER:introduced=0,fixed=5.1.0; passport-saml (npm) SEMVER:introduced=0,last_affected=3.2.4.
Is there a fix for CVE-2025-54419?
Yes. @node-saml/node-saml (npm): upgrade to 5.1.0 or later; @node-saml/passport-saml (npm): upgrade to 5.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54419 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-54419?
Check whether you run @node-saml/node-saml (npm), @node-saml/passport-saml (npm) or passport-saml (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @node-saml/node-saml (npm): upgrade to 5.1.0 or later
    npm install @node-saml/node-saml@5.1.0
  • @node-saml/passport-saml (npm): upgrade to 5.1.0 or later
    npm install @node-saml/passport-saml@5.1.0

Technical details

The vulnerability is a signature verification bypass in SAML assertion processing (CWE-287, CWE-347). Node-SAML extracts authentication assertions from the unsigned original response document rather than from the cryptographically verified/signed portions of the SAML message. This allows an attacker who possesses a validly signed SAML response from a trusted identity provider to modify assertion contents (e.g., remove characters from usernames) before the modified assertion is processed by the application. The attacker does not need privileges or user interaction; the attack is network-accessible and has broad scope. The fix leverages a new `.signedReferences` interface in xml-crypto (v6.1.2+) to ensure assertions are loaded exclusively from verified signed content, eliminating variants of this vulnerability class. Patched versions: @node-saml/node-saml ≥5.1.0, @node-saml/passport-saml ≥5.1.0.

Affected products

  • Node-SAML @node-saml/node-saml <=5.0.1
  • Node-SAML @node-saml/passport-saml <=5.0.1
  • Node-SAML passport-saml <=3.2.4

Identifiers

  • CVE-2025-54419
  • GHSA-4mxg-3p6v-xgq3

Timeline

  • 2025-07-28: disclosed: GHSA-4mxg-3p6v-xgq3 and CVE-2025-54419 published
  • 2025-07-21: patched: Fix committed to master; v5.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.