Skip to content
OpenAdvisories

Package · npm

@node-saml/node-saml

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Critical 9.3
    CVE-2025-54369

    Node-SAML SAML Authentication Bypass

    Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signatur…

    node-saml node-saml @node-saml/node-saml node-saml npm
  • Critical 10.0
    CVE-2025-54419

    Node-SAML Contains SAML Signature Verification Vulnerability

    A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attack…

    node-saml node-saml @node-saml/node-saml passport-saml npm
  • Medium 5.3
    CVE-2023-40178

    @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

    Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user whe…

    node-saml node-saml @node-saml/node-saml npm
  • High 7.4
    CVE-2022-39299 Public exploit

    Signature bypass via multiple root elements in Passport-SAML

    Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession…

    node-saml passport-saml @node-saml/node-saml passport-saml npm