CVE-2026-89043

EUVD-2026-75632
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.4 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/krakenjs/passport-saml-encrypted
https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256
https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328
https://github.com/krakenjs/passport-saml-encrypted/issues/30
https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending
https://github.com/krakenjs/passport-saml-encrypted/issues/30