CVE-2025-47949

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

Signature Wrapping Attack

samlify is vulnerable to a Signature Wrapping attack. The vulnerability is due to improper validation of signed XML documents, allowing an attacker to forge a SAML Response and authenticate as any user...

keycloak:SamlValidationUtilFuzzer: Security exception in java.base/java.util.Arrays.copyOf

Detailed Report: https://oss-fuzz.com/testcase?key=6391262708301824 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlValidationUtilFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State: java.base/java.util.Arrays.copyOf...

samlify SAML Signature Wrapping attack

A Signature Wrapping attack has been found in samlify v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider...

GHSA-R683-V43C-6XQV samlify SAML Signature Wrapping attack

A Signature Wrapping attack has been found in samlify v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider...

@arc-directus/api (>=12.0.0, <=12.0.6), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.5) +46 more potentially affected by CVE-2025-47949 via samlify (>=2.5.1, <=2.9.1)

samlify NPM version =2.5.1, =12.0.0, =1.6.3, =1.0.0, =1.0.0, =2.0.0, =9.25.0, =9.26.0, =14.0.1, =3.1.5, =1.2.2, =1.0.0-beta.1, =1.3.0 - @meta-factory/cms 0.1.1 and more Source cves: CVE-2025-47949 Source advisory: OSV:GHSA-R683-V43C-6XQV...

CVE-2025-47949

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

CVE-2025-47949

Summary: samlify (Node.js SAML library) has a Signature Wrapping vulnerability in versions prior to 2.10.0, enabling an attacker to forge a SAML Response to impersonate any user. An attacker would need a signed XML document from the identity provider. Fix/mitigation: Upgrade to version 2.10.0 or ...

CVE-2025-47949

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

CVE-2025-47949 samlify SAML Signature Wrapping attack

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

openslides (2.2.0), openslides-presenter (2.0.3) +2 more potentially affected by CVE-2025-47273 via setuptools (38.7.0)

setuptools PYPI version 38.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - openslides 2.2.0 - openslides-presenter 2.0.3 - openslides-protocol 1.0.0 - openslides-saml 1.0.0 Source cves: CVE-2025-47273 Source...

CVE-2025-47949: Improper Verification of Cryptographic Signature

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fix...

PT-2025-22111

Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.10.0 Description A Signature Wrapping attack has been found in samlify, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provide...

openslides (2.2.0), openslides-presenter (2.0.3) +2 more potentially affected by CVE-2025-47273 via setuptools (38.7.0)

setuptools PYPI version 38.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - openslides 2.2.0 - openslides-presenter 2.0.3 - openslides-protocol 1.0.0 - openslides-saml 1.0.0 Source cves: CVE-2025-47273 Source...

Security Bulletin: Astronomer with IBM is vulnerable to remote attacks due to the crewjam saml package (CVE-2020-27846).

Summary crewjam saml is used by Astronomer with IBM as part of identity verification. Vulnerability Details CVEID:CVE-2020-27846 DESCRIPTION: crewjam saml could allow a remote attacker to bypass security restrictions, caused by a signature verification vulnerability. By sending a specially-crafte...

Authentication Bypass

passport-wsfed-saml2 is vulnerable to Authentication Bypass. The vulnerability is due to insufficient validation of SAML response attributes due to the ability to tamper with a valid signed SAML response to impersonate users...

Authentication Bypass

passport-wsfed-saml2 is vulnerable to Authentication Bypass. The vulnerability is due to improper validation of the SAML assertion recipient and insecure handling of signed SAML objects, which allows attackers to reuse valid assertions to impersonate users...

CVE-2025-46572

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a val...

CVE-2025-46573

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done b...

Security update for opensaml

This update for opensaml fixes the following issues: CVE-2025-31335: Fixed parameter manipulation allowing forging signed SAML messages bsc1239889 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively...