Homepage
About Snyk

@node-saml/passport-saml@4.0.0-beta.1 vulnerabilities

SAML 2.0 authentication strategy for Passport

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the @node-saml/passport-saml package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Verification of Cryptographic Signature

@node-saml/passport-saml is a SAML 2.0 authentication strategy for Passport

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature by allowing a remote attacker to bypass SAML authentication on a website using passport-saml.

Note A successful attack requires that the attacker is in possession of an arbitrary IDP-signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g, without access to a valid user) might also be feasible if the generation of a signed message can be triggered.

How to fix Improper Verification of Cryptographic Signature?

Upgrade @node-saml/passport-saml to version 4.0.0-beta.3 or higher.

<4.0.0-beta.3
Go back to all versions of this package