xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

🗓️ 14 Mar 2025 17:14:23Reported by GitHub Advisory DatabaseType

xml-crypto vulnerability allows bypass of XML signature verification affecting user authentication.

Reporter	Title	Published	Views	Family All 24
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto (CVE-2025-27152, CVE-2025-29774, CVE-2025-29775 and CVE-2024-57965)	16 Apr 202515:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Verification of Cryptographic Signature due to xml-crypto ( CVE-2025-29774, CVE-2025-29775 )	20 Jun 202506:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypass signature validation in XML data [CVE-2025-29774] [CVE-2025-29775]	8 May 202517:57	–	ibm
Chainguard	CVE-2025-29774 vulnerabilities	17 Mar 202522:12	–	cgr
Circl	CVE-2025-29774	14 Mar 202518:40	–	circl
CNNVD	NPM xml-crypto 数据伪造问题漏洞	14 Mar 202500:00	–	cnnvd
CVE	CVE-2025-29774	14 Mar 202517:05	–	cve
Cvelist	CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References	14 Mar 202517:05	–	cvelist
EUVD	EUVD-2025-7890	3 Oct 202520:07	–	euvd
NVD	CVE-2025-29774	14 Mar 202517:15	–	nvd

Vulners

Node

xml-cryptoRange<2.1.6npm

xml-cryptoRange3.0.0–3.2.1npm

xml-cryptoRange4.0.0–6.0.1npm

Source	Link
github	www.github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g
github	www.github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed
github	www.github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
github	www.github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
github	www.github.com/node-saml/xml-crypto/releases/tag/v2.1.6
github	www.github.com/node-saml/xml-crypto/releases/tag/v3.2.1
github	www.github.com/node-saml/xml-crypto/releases/tag/v6.0.1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-29774
workos	www.workos.com/blog/samlstorm
github	www.github.com/advisories/GHSA-9p8x-f768-wp2g

16 Mar 2025 21:34Current

7High risk

Vulners AI Score7

CVSS 49.3

EPSS0.00472

SSVC