Skip to content
OpenAdvisories

Package · npm

samlify

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.7
    CVE-2026-46490 Public exploit

    samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

    samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML marku…

    tngan samlify samlify npm
  • High 7.5
    CVE-2017-1000452

    Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames

    An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.

    samlify npm