59 matches found
CVE-2023-40178
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. This could impact the user where they would be logged out from an...
Authentication Bypass
Node-SAML is vulnerable to an Authentication Bypass. The vulnerability is due to loading assertions from the unsigned original SAML response instead of the signature-verified data, allowing attackers to modify authentication details within a valid assertion, such as altering the username, and...
CVE-2025-54369
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
CVE-2025-54369 Node-SAML SAML Authentication Bypass
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
CVE-2025-54369: Improper Neutralization of Alternate XSS Syntax
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
EUVD-2023-2365
Malicious code in bioql PyPI...
@digabi/passport-utils (>=0.0.1, <=0.0.2), cloudcms-server (>=3.2.324, <=4.0.0-beta.22) potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=5.0.0, <=5.0.1)
@node-saml/passport-saml NPM version =5.0.0, =0.0.1, =3.2.324, =4.0.0-beta.22 Source cves: CVE-2025-54419 Source advisory: GHSA-4MXG-3P6V-XGQ3...
Node-SAML SAML Signature Verification Vulnerability
Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any...
CVE-2025-54419
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
@alesmenzel/passport-saml (4.0.0), @allanoricil/flowforge (>=0.0.1, <=0.0.9) +31 more potentially affected by CVE-2025-54419 via @node-saml/node-saml (4.0.5)
@node-saml/node-saml NPM version 4.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on @node-saml/node-saml and may be impacted: - @alesmenzel/passport-saml 4.0.0 - @allanoricil/flowforge =0.0.1, =0.9.0, =0.9.0, =0.0.0-nightly-20230826020825,...
CVE-2025-54419
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
@allanoricil/flowforge (>=0.0.1, <=0.0.9), @andreacioni/saml2-nest-lib (0.0.7) +20 more potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=4.0.4, <=5.0.1)
@node-saml/passport-saml NPM version =4.0.4, =0.0.1, =0.9.0, =0.9.0, =0.0.0-nightly-20230826020825, =0.1.15-next.2, =0.2.4-next.2, =0.0.1, =0.89.0, =1.7.0, =1.14.1, =10.0.1, =6.2.10-beta.1, =1.4.34, =1.4.35 and more Source cves: CVE-2025-54419 Source advisory: MEND:CVE-2025-54419...
CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
CVE-2025-54419
CVE-2025-54419 – Node-SAML (Node.js) : Affected component is the node-saml library. In v5.0.1, it loads the SAML assertion from the unsigned original response document, separate from the parts that are verified for signature. This mismatch allows an attacker who has a validly signed IdP document ...
CVE-2025-54419 Node-SAML Contains SAML Signature Verification Vulnerability
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
CVE-2025-54419: Improper Authentication
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details with...
Node-SAML security vulnerability
node-saml is a SAML library that does not depend on any framework running in Node.js. A security vulnerability exists in node-saml version 5.0.1 that stems from not properly validating SAML assertions, which could lead to an authentication bypass...
PT-2025-31149
Name of the Vulnerable Software and Affected Versions: Node-SAML versions 5.0.1 and below Description: Node-SAML improperly loads the assertion from the unsigned original response document, differing from the parts verified during signature checking. This allows modification of authentication...
Node-SAML SAML Authentication Bypass
Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any...