critical9.3
CVE-2025-46572
Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping
Impact
### Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. ### Am I Affected? You are affected by this SAML Signature Wrapping vulnerability if you are using `passport-wsfed-saml2` version 4.6.3 or below, specifically under the following conditions: 1. The service provider is using `passport-wsfed-saml2`, 2. A valid SAML document signed by the Identity Provider can be obtained. ### Fix Upgrade to v4.6.4 or greater.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | passport-wsfed-saml2 | >= 3.0.5, <= 4.6.3 | 4.6.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181
- https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-wjmp-wphq-jvqf
- https://github.com/advisories/GHSA-wjmp-wphq-jvqf
- https://nvd.nist.gov/vuln/detail/CVE-2025-46572