PT-2023-32981 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: passport-wsfed-saml2 versions prior to 3.0.10 Description: A vulnerability was found in the validation of a SAML signature, where the validation doesn't ensure that the Signature tag is at the proper location inside an Assertion tag. This lea...

Authentication Bypass

passport-wsfed-saml2 is vulnerable to authentication bypass. The vulnerability exists in the retrieveToken function of wsfederation.js due to a lack of proper validation when more than one assertion is inside a token response for WS-Fed, which allows an attacker to bypass WSFed authentication...

Authentication Bypass for passport-wsfed-saml2

Overview A remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid us...

GHSA-PPJQ-QXHX-M25F Authentication Bypass for passport-wsfed-saml2

Overview A remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks e.g without access to a valid us...

Authentication flaw

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession...

CVE-2022-23505 Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession...

CVE-2022-23505

Passport-wsfed-saml2 (Node.js Passport strategy) prior to 4.6.3 is vulnerable to authentication bypass: an attacker who possesses an arbitrary IDP-signed WSFed assertion may bypass WSFed authentication on websites using the library. Depending on the IDP, fully unauthenticated (no valid user) atta...

PT-2022-16038 · Unknown · Passport-Wsfed-Saml2

Name of the Vulnerable Software and Affected Versions: Passport-wsfed-saml2 versions prior to 4.6.3 Description: A remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary ID...

GHSA-7FPW-CFC4-3P2C Duplicate advisory: High severity vulnerability that affects passport-wsfed-saml2

Duplicate advisory This advisory has been withdrawn because it is a duplicate of GHSA-77fw-rf4v-vfp9. This link is maintained to preserve external references. Original Description A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

Auth0 passport-wsfed-saml2 elevation of privilege vulnerability

Auth0 passport-wsfed-saml2 library is a set of Auth0 development platform of the United States Auth0 company's tool library . A security vulnerability exists in Auth0 passport-wsfed-saml2 library versions prior to 3.0.5. An attacker can exploit the vulnerability to spoof other users and potential...

CVE-2017-16897

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response e.g., only signs th...

CVE-2017-16897

The CVE pertains to the Auth0 passport-wsfed-saml2 library prior to version 3.0.5. The vulnerability allows an attacker to impersonate another user and potentially elevate privileges if the SAML identity provider signs only the Assertion (not the full SAML response). This root cause involves inco...