Executive brief
Node-SAML is a popular Node.js library that implements SAML single sign-on authentication. The library has a critical flaw where it extracts user authentication details from unverified portions of SAML responses, allowing attackers to modify usernames and other attributes even when the overall SAML response is cryptographically signed by a legitimate identity provider. An attacker with a valid signed response could alter their username or other claims to gain unauthorized access. This is fixed in version 5.1.0.
Technical details
The vulnerability is a signature verification bypass in SAML assertion processing (CWE-287, CWE-347). Node-SAML extracts authentication assertions from the unsigned original response document rather than from the cryptographically verified/signed portions of the SAML message. This allows an attacker who possesses a validly signed SAML response from a trusted identity provider to modify assertion contents (e.g., remove characters from usernames) before the modified assertion is processed by the application. The attacker does not need privileges or user interaction; the attack is network-accessible and has broad scope. The fix leverages a new `.signedReferences` interface in xml-crypto (v6.1.2+) to ensure assertions are loaded exclusively from verified signed content, eliminating variants of this vulnerability class. Patched versions: @node-saml/node-saml ≥5.1.0, @node-saml/passport-saml ≥5.1.0.
Affected products
- Node-SAML @node-saml/node-saml <=5.0.1
- Node-SAML @node-saml/passport-saml <=5.0.1
- Node-SAML passport-saml <=3.2.4
Timeline
- 2025-07-28: disclosed: GHSA-4mxg-3p6v-xgq3 and CVE-2025-54419 published
- 2025-07-21: patched: Fix committed to master; v5.1.0 released