Passport Saml Encrypted Through 0.1.13 Xml Signature Wrapping Via Assertion Prepending

Back www.vulncheck.com

Passport Saml Encrypted Through 0.1.13 Xml Signature Wrapping Via Assertion Prepending

www.vulncheck.com • September 11, 2026

Share: View original

passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

passport-saml-encrypted <= 0.1.13

passport-saml-encrypted <= 0.1.13

CWE-347 Improper Verification of Cryptographic Signature

Reporter advisory: XML signature wrapping

Signature located by an unconstrained XPath at v0.1.13

Assertion selected by a separate first-match XPath at v0.1.13

krakenjs/passport-saml-encrypted

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical XML Signature Wrapping Vulnerability in passport-saml-encrypted The passport-saml-encrypted library version 0.1.13 contains a critical XML signature wrapping vulnerability, identified as CVE-2026-89043, allowing attackers to prepend forged unsigned assertions to validly signed SAML messages. This flaw enables identity impersonation, potentially leading to account takeovers and unauthorized access to sensitive applications. The vulnerability arises from independent XPath lookups for signature verification and assertion extraction, which lack cross-validation. Organizations using this library, particularly in internet-facing Node.js applications, are at high risk. Public proof-of-concept evidence has been released, increasing concerns about potential exploitation, although active exploitation has not yet been confirmed. Immediate action is recommended to mitigate risks associated with this vulnerability. 3 sources 71

Extracted Entities

CWE Weaknesses (1)

CWE-347 - Improper Verification of Cryptographic Signature

Vulnerabilities (1)

XML Signature Wrapping Via Assertion Prepending