44 matches found
CVE-2026-46490-samlify-SAML-Attribute-Injection
CVE-2026-46490 — samlify SAML AttributeValue XML 注入 → 权限提升 samlifyValue — 时被未经转义 地插入，因此普通用户可以向其自身、IdP签名 的 SAML 断言中注入额外的 元素（例如 role=admin）。由于注入发生在签名之前，服务提供商的签名检查通过，并会将伪造的属性视为权威属性。 | ---|--- CVE| CVE-2026-46490 公告| GHSA-34r5-q4jw-r36m 受影响| samlify rawXML = rawXML.replacenew RegExp"?\$t\, 'g',...
CVE-2026-55789: XML Injection (aka Blind XPath Injection)
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's self-hosted SAML application IdP built the signed SAML response and assertion by string-substituting user-controlled profile attributes such as name, email, and custom attribute-mapping values into...
ROOT-APP-NPM-CVE-2026-46490 CVE-2026-46490 in @rootio/samlify - Patched by Root
Root has patched CVE-2026-46490 in the @rootio/samlify package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-47949 CVE-2025-47949 in @rootio/samlify - Patched by Root
Root has patched CVE-2025-47949 in the @rootio/samlify package for Root:npm. Multiple fixed versions available...
CVE-2026-46490
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
CVE-2026-46490
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
CVE-2026-46490 samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
CVE-2026-46490
CVE-2026-46490 affects samlify (Node.js) prior to v2.13.0. The issue: template substitution only escapes attribute contexts; values placed in element text (e.g., saml:AttributeValue ) aren’t escaped. An attacker can inject XML markup into attribute values (e.g., email, name) and insert new saml:A...
EUVD-2026-35188
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
CVE-2026-46490
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
samlify 安全漏洞
Samlify is a Node.js library developed by TNGAN’s individual developers, used for SAML SSO. Versions of Samlify prior to 2.13.0 contained security vulnerabilities. These vulnerabilities stemmed from template substitution only escaping attribute contexts, while values within element texts were not...
CVE-2026-46490: XML Injection (aka Blind XPath Injection)
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elemen...
@altipla/directus-sdk-utils (0.7.2), @arc-directus/api (>=12.0.0, <=12.0.6) +69 more potentially affected by CVE-2026-46490 via samlify (>=2.5.1, <=2.12.0)
samlify NPM version =2.5.1, =12.0.0, =1.6.0, =1.6.3, =2.10.4, =1.0.0-beta.1, =1.0.0, =1.0.0, =11.16.1-depup.0, =2.0.0, =9.25.0, =9.26.0, =9.26.2 and more Source cves: CVE-2026-46490 Source advisory: SNYK:JS-SAMLIFY-16796318...
NPM: samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
NPM: samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions vulnerability discovered by ? in WordPress Npm samlify versions 2.13.0...
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
Summary samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elements inside the signed assertion. The IdP then signs the tampered asserti...
XML Injection
Overview samlify is a Highly configuarable Node.js SAML 2.0 library for Single Sign On. Affected versions of this package are vulnerable to XML Injection via the replaceTagsByValue function. An attacker can inject arbitrary XML markup into SAML assertions by supplying crafted attribute values,...
@altipla/directus-sdk-utils (0.7.2), @arc-directus/api (>=12.0.0, <=12.0.6) +69 more potentially affected by CVE-2026-46490 via samlify (>=2.5.1, <=2.12.0)
samlify NPM version =2.5.1, =12.0.0, =1.6.0, =1.6.3, =2.10.4, =1.0.0-beta.1, =1.0.0, =1.0.0, =11.16.1-depup.0, =2.0.0, =9.25.0, =9.26.0, =9.26.2 and more Source cves: CVE-2026-46490 Source advisory: OSV:GHSA-34R5-Q4JW-R36M...
PT-2026-42587
Summary samlify’s template substitution only escapes attribute contexts. Values inserted into element text e.g., are not escaped. A normal user can inject XML markup into an attribute value e.g., email, name and add new elements inside the signed assertion. The IdP then signs the tampered asserti...
PT-2026-42665
Name of the Vulnerable Software and Affected Versions samlify versions prior to 2.13.0 Description samlify is a Node.js library for SAML single sign-on. The template substitution mechanism only escapes attribute contexts, meaning values inserted into element text, such as , are not escaped. This...