CVE-2022-39299_PoC_Generator

利用 CVE-2022-39299 通过多个根元素绕过签名 公告 : https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 补丁 : https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e 从 node-saml 测试用例中提取的基础 Payload...

CVE-2026-89043

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89042

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89043 passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89043

passport-saml-encrypted through version 0.1.13 is affected by an XML signature wrapping vulnerability. The root cause is that signature verification and assertion extraction use independent XPath lookups with no cross-validation (see saml.js lines 256 and 328). An attacker holding any validly sig...

EUVD-2026-75632

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-89042

passport-saml-encrypted through version 0.1.13 contains an authentication bypass vulnerability in its SAML signature verification logic. The signature check is conditional on an optional cert option; when this option is not configured, SAML responses are accepted without signature verification . ...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

EUVD-2026-75631

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consum...

EUVD-2021-1569

Malware in sbrugna...

EUVD-2022-7124

Malicious code in bioql PyPI...

@digabi/passport-utils (>=0.0.1, <=0.0.2), cloudcms-server (>=3.2.324, <=4.0.0-beta.22) potentially affected by CVE-2025-54419 via @node-saml/passport-saml (>=5.0.0, <=5.0.1)

@node-saml/passport-saml NPM version =5.0.0, =0.0.1, =3.2.324, =4.0.0-beta.22 Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

@andreacioni/saml2-nest-lib (>=0.0.2, <=0.0.7), @backstage/plugin-auth-backend (>=0.0.0-nightly-2021101022158, <=0.12.3) +51 more potentially affected by CVE-2025-54419 via passport-saml (>=3.2.0, <=3.2.4)

passport-saml NPM version =3.2.0, =0.0.2, =0.0.0-nightly-2021101022158, =0.0.0-nightly-202201422556, =0.1.0, =0.1.0, =0.4.0, =0.2.1, =0.35.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3 and more Source cves: CVE-2025-54419 Source advisory: OSV:GHSA-4MXG-3P6V-XGQ3...

CVE-2021-39171

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. Prior to version 3.1.0, a malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an...

CVE-2022-39299

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML elemen...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass SAML authentication due to passport-saml ( CVE-2022-39299 )

Summary Passport-saml is used by IBM Cloud Pak for Data for SAML authentication. CVE-2022-39299. Vulnerability Details CVEID:CVE-2022-39299 DESCRIPTION: Node.js passport-saml module could allow a remote attacker to bypass security restrictions, caused by improper verification of cryptographic...

Exploit for Improper Verification of Cryptographic Signature in Passport-Saml_Project Passport-Saml

Exploiting CVE-2022-39299 Signature bypass via multiple ro...

Improper Verification Of Cryptographic Signature

Passport-saml is vulnerable to improper cryptographic signature verification. A remote attacker is able to bypass SAML authentication via an arbitrary IDP signed XML element, due to improper checks for a valid top-level signature in saml.ts...