Elevation Of Privileges

passport-wsfed-saml2 is vulnerable to elevation of privileges. When a SAML identity provider doesn't sign the entire SAML response, attackers can change the NameIdentifier to login as a different user. The attacker needs either be able to intercept encrypted traffic and modify SAML responses on t...

Design/Logic Flaw

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

F5 Networks BIG-IP : TMM SSO plugin vulnerability (K95444512)

The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider with a Service Provider SP connector, might allow traffic to be disrupted or failover initiated when a malformed, signed SAML authentication request from an...