critical9.9
CVE-2025-47949
samlify SAML Signature Wrapping attack
Impact
A Signature Wrapping attack has been found in samlify <v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | samlify | < 2.10.0 | 2.10.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Samlify Project | Samlify | before 2.10.0 |