Critical XML Signature Wrapping Vulnerability in passport-saml-encrypted

• •CVE-2026-89043 affects passport-saml-encrypted version 0.1.13.
• •Attackers can exploit this flaw to impersonate identities without the signing key.
• •Immediate upgrade to a fixed version is necessary to mitigate risks.

The passport-saml-encrypted library version 0.1.13 contains a critical XML signature wrapping vulnerability, identified as CVE-2026-89043, allowing attackers to prepend forged unsigned assertions to validly signed SAML messages. This flaw enables identity impersonation, potentially leading to account takeovers and unauthorized access to sensitive applications. The vulnerability arises from independent XPath lookups for signature verification and assertion extraction, which lack cross-validation. Organizations using this library, particularly in internet-facing Node.js applications, are at high risk. Public proof-of-concept evidence has been released, increasing concerns about potential exploitation, although active exploitation has not yet been confirmed. Immediate action is recommended to mitigate risks associated with this vulnerability.