Summary
CVE-2026-89043 is a critical XML Signature Wrapping (XSW) vulnerability in passport-saml-encrypted, a Node.js Passport strategy for encrypted SAML authentication. The flaw allows any attacker in possession of a single validly signed SAML message to forge a completely different identity assertion — including admin-level roles — that the library accepts as cryptographically verified. The issue is rated critical severity (CVSS v4.0 9.1) and affects all published versions through 0.1.13.
Technical details
- Root cause:
lib/saml.jsperforms signature verification and assertion extraction as two independent, uncoordinated XPath lookups. The signature-verification routine locates and validates the first<Signature>element it finds, while a separate routine independently selects the first<Assertion>element to extract identity/attribute data for the authenticated session. - Missing control: Nothing in the code resolves the signature’s
<Reference URI="#...">back to a specific, unambiguous element and confirms it is the same node used for attribute/identity extraction — the two operations never cross-validate that they examined the same assertion. - Trigger conditions: An attacker who possesses any validly signed SAML response or assertion (e.g., their own legitimate IdP-issued response) can prepend an additional, unsigned, forged
<Assertion>element earlier in the document. The library’s signature check still validates true (against the original, legitimate assertion), while its attribute-extraction logic picks up the attacker-controlled forged assertion instead. - Attack vector: Network-based; no user interaction is required and no elevated privileges are needed beyond holding one legitimately signed SAML message, making this exploitable by any authenticated (even low-privileged) user of the SAML flow.
- Impact: Full authentication/identity bypass — an attacker can impersonate arbitrary users, including administrative or high-privilege accounts, by controlling the username, email, and role attributes accepted by the relying application. Confidentiality and integrity impacts are high; availability is not affected.
Affected software
passport-saml-encrypted(npm package, krakenjs), all versions 0 through 0.1.13 (inclusive)
Severity
- CVSS v3.1 Base Score: 7.4 (High) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS v4.0 Base Score: 9.1 (Critical) —
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CWE-347: Improper Verification of Cryptographic Signature
Mitigation and recommended actions
- Immediate: No patched release is currently available for
passport-saml-encrypted; all versions through 0.1.13 remain affected. Security teams should treat any deployment of this package as vulnerable and prioritize remediation. - Workarounds (no patch available):
- Discontinue use of
passport-saml-encryptedand migrate to an actively maintained SAML library that binds signature verification to the specific assertion node referenced by the signature (e.g., resolves<Reference URI>to a single, unambiguous element before trusting it). - If migration is not immediately feasible, apply a custom patch that rejects SAML documents containing multiple
<Assertion>elements, or that explicitly resolves the signature’s reference URI to the exact assertion element before extracting attributes, rejecting the message if they do not match. - Reject SAML responses/assertions containing duplicate
IDattributes or multiple assertions where only one is expected. - Restrict which identity providers and SAML endpoints are trusted, and monitor SAML traffic for responses containing more than one
<Assertion>element, which is a strong indicator of signature-wrapping attempts.
- Discontinue use of