CVE-2022-39299_PoC_Generator

利用 CVE-2022-39299 通过多个根元素绕过签名 公告 : https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 补丁 : https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e 从 node-saml 测试用例中提取的基础 Payload...

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

EUVD-2026-75632

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89043

passport-saml-encrypted through version 0.1.13 is affected by an XML signature wrapping vulnerability. The root cause is that signature verification and assertion extraction use independent XPath lookups with no cross-validation (see saml.js lines 256 and 328). An attacker holding any validly sig...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89042

passport-saml-encrypted through version 0.1.13 contains an authentication bypass vulnerability in its SAML signature verification logic. The signature check is conditional on an optional cert option; when this option is not configured, SAML responses are accepted without signature verification . ...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

EUVD-2026-75631

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-86762

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86755

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86754

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86762 Snipe-IT before 8.7.0 Authentication Bypass via API Middleware

Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the api middleware group in app/Http/Kernel.php, and deactivating a user does not revoke that user's Passport personal access tokens. As a result, although a deactivated account is correctly refused at web login, its...

CVE-2026-86755 Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes GET, POST, DELETE /oauth/personal-access-tokens with only 'web' and 'auth:web' middleware, without the self.api permission gate that Snipe-IT enforces on its own token endpoints /account/a...

CVE-2026-86754

Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

EUVD-2026-74931

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...