CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

🗓️ 14 Mar 2025 17:05:53Reported by GoogleType

osv

osv🔗 osv.dev👁 5 Views

Vulnerability CVE-2025-29774 in xml-crypto affects Node.js user authentication and authorization.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js modules axios and xml-crypto (CVE-2025-27152, CVE-2025-29774, CVE-2025-29775 and CVE-2024-57965)	16 Apr 202515:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to Improper Verification of Cryptographic Signature due to xml-crypto ( CVE-2025-29774, CVE-2025-29775 )	20 Jun 202506:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to bypass signature validation in XML data [CVE-2025-29774] [CVE-2025-29775]	8 May 202517:57	–	ibm
BDU FSTEC	The vulnerability of the digital signature and XML encryption library for Node.js’ xml-crypto, related to improper verification of cryptographic signatures, allows attackers to escalate their privileges.	9 Apr 202500:00	–	bdu_fstec
Chainguard	CVE-2025-29774 vulnerabilities	17 Mar 202522:12	–	cgr
Circl	CVE-2025-29774	14 Mar 202518:40	–	circl
CNNVD	NPM xml-crypto 数据伪造问题漏洞	14 Mar 202500:00	–	cnnvd
CVE	CVE-2025-29774	14 Mar 202517:05	–	cve
Cvelist	CVE-2025-29774 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References	14 Mar 202517:05	–	cvelist
EUVD	EUVD-2025-7890	3 Oct 202520:07	–	euvd

Source	Link
github	www.github.com/node-saml/xml-crypto/releases/tag/v2.1.6
github	www.github.com/node-saml/xml-crypto/releases/tag/v3.2.1
github	www.github.com/node-saml/xml-crypto/releases/tag/v6.0.1
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29774.json
github	www.github.com/node-saml/xml-crypto/security/advisories/GHSA-9p8x-f768-wp2g
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-29774
github	www.github.com/node-saml/xml-crypto/commit/28f92218ecbb8dcbd238afa4efbbd50302aa9aed
github	www.github.com/node-saml/xml-crypto/commit/886dc63a8b4bb5ae1db9f41c7854b171eb83aa98
github	www.github.com/node-saml/xml-crypto/commit/8ac6118ee7978b46aa56b82cbcaa5fca58c93a07
workos	www.workos.com/blog/samlstorm

10 Apr 2026 05:24Current

8.4High risk

Vulners AI Score8.4

CVSS 49.3

EPSS0.00472

vulnerability xml-crypto node.js authentication authorization version upgrade privilege escalation