Ruby SAML DOS vulnerability with large SAML response

Summary A denial-of-service vulnerability exists in ruby-saml even with the messagemaxbytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. Details ruby-saml...

Improper Verification of Cryptographic Signature

Overview @node-saml/node-saml is a SAML 2.0 implementation for Node.js Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via validatePostResponseAsync due to loading of the assertion from the unsigned original response document. An attacker can...

@andreacioni/saml2-nest-lib (>=0.0.2, <=0.0.7), @backstage/plugin-auth-backend (>=0.0.0-nightly-2021101022158, <=0.12.3) +51 more potentially affected by CVE-2025-54419 via passport-saml (>=3.2.0, <=3.2.4)

passport-saml NPM version =3.2.0, =0.0.2, =0.0.0-nightly-2021101022158, =0.0.0-nightly-202201422556, =0.1.0, =0.1.0, =0.4.0, =0.2.1, =0.35.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3 and more Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

@andreacioni/saml2-nest-lib (>=0.0.2, <=0.0.7), @backstage/plugin-auth-backend (>=0.0.0-nightly-2021101022158, <=0.12.3) +51 more potentially affected by CVE-2025-54419 via passport-saml (>=3.2.0, <=3.2.4)

passport-saml NPM version =3.2.0, =0.0.2, =0.0.0-nightly-2021101022158, =0.0.0-nightly-202201422556, =0.1.0, =0.1.0, =0.4.0, =0.2.1, =0.35.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3 and more Source cves: CVE-2025-54419 Source advisory: GHSA-4MXG-3P6V-XGQ3...

Node-SAML SAML Signature Verification Vulnerability

Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any...

@digabi/passport-utils (>=0.0.1, <=0.0.2), cloudcms-server (>=3.2.324, <=4.0.0-beta.22) potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=5.0.0, <=5.0.1)

@node-saml/passport-saml NPM version =5.0.0, =0.0.1, =3.2.324, =4.0.0-beta.22 Source cves: CVE-2025-54419 Source advisory: GHSA-4MXG-3P6V-XGQ3...

@digabi/passport-utils (>=0.0.1, <=0.0.2), cloudcms-server (>=3.2.324, <=4.0.0-beta.22) potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=5.0.0, <=5.0.1)

@node-saml/passport-saml NPM version =5.0.0, =0.0.1, =3.2.324, =4.0.0-beta.22 Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

CVE-2025-54419

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419

CVE-2025-54419 – Node-SAML (Node.js) : Affected component is the node-saml library. In v5.0.1, it loads the SAML assertion from the unsigned original response document, separate from the parts that are verified for signature. This mismatch allows an attacker who has a validly signed IdP document ...

@allanoricil/flowforge (>=0.0.1, <=0.0.9), @andreacioni/saml2-nest-lib (0.0.7) +20 more potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=4.0.4, <=5.0.1)

@node-saml/passport-saml NPM version =4.0.4, =0.0.1, =0.9.0, =0.9.0, =0.0.0-nightly-20230826020825, =0.1.15-next.2, =0.2.4-next.2, =0.0.1, =0.89.0, =1.7.0, =1.14.1, =10.0.1, =6.2.10-beta.1, =1.4.34, =1.4.35 and more Source cves: CVE-2025-54419 Source advisory: MEND:CVE-2025-54419...

@alesmenzel/passport-saml (4.0.0), @allanoricil/flowforge (>=0.0.1, <=0.0.9) +31 more potentially affected by CVE-2025-54419 via @node-saml/node-saml (4.0.5)

@node-saml/node-saml NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @node-saml/node-saml and may be impacted: - @alesmenzel/passport-saml 4.0.0 - @allanoricil/flowforge =0.0.1, =0.9.0, =0.9.0, =0.0.0-nightly-20230826020825,...

CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

CVE-2025-54419

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

Improper Authentication

goauthentik.io is vulnerable to improper authentication. The vulnerability is due to deactivated users who registered or linked accounts via OAuth/SAML retaining partial access, which allows an attacker to authorize applications if they know the application URL, despite their account being...

Node-SAML security vulnerability

node-saml is a SAML library that does not depend on any framework running in Node.js. A security vulnerability exists in node-saml version 5.0.1 that stems from not properly validating SAML assertions, which could lead to an authentication bypass...

CVE-2025-54419: Improper Authentication

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...

PT-2025-31149

Name of the Vulnerable Software and Affected Versions: Node-SAML versions 5.0.1 and below Description: Node-SAML improperly loads the assertion from the unsigned original response document, differing from the parts verified during signature checking. This allows modification of authentication...

CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...