Description
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| krakenjs | passport-saml-encrypted | ≤ 0.1.13 | — |
References
- Reporter advisory: authentication bypass when cert is not configured issue-tracking
- Signature check gated on options.cert at v0.1.13 technical-description
- Same gate on the decrypted-assertion path at v0.1.13 technical-description
- krakenjs/passport-saml-encrypted product
- VulnCheck Advisory: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification third-party-advisory