passport-saml-encrypted

Published September 10, 2026 CVE-2026-89042

passport-saml-encrypted can let an attacker get an authenticated profile with a chosen account name and attributes. The attack works when the application does not configure a trusted certificate.

Severity
CriticalCVSS 3.1 · 9.1
Fix
Not confirmedLast checked today
Affected versions
through 0.1.13
Weakness
CWE-347Improper Verification of Cryptographic Signature
Exploit likelihood
0.27% in 30 daysEPSS, higher than 19% of known flaws
Affects
passport-saml-encrypted
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: partial
EU ID
EUVD-2026-75631ENISA vulnerability database

How it works

  • An application using the package receives a SAML response at its login callback.
  • In version 0.1.13, the package checks the response signature only when cert is configured.
  • If cert is omitted, it accepts unsigned responses with attacker-controlled names and account attributes.
  • The resulting profile can be treated as authenticated.

What to do

Run npm list passport-saml-encrypted in each application environment. Versions 0.1.13 or earlier are in scope, then check whether the SAML strategy configures the identity provider's trusted certificate.

Run this in the application environment you want to check:

npm list passport-saml-encrypted

Configure the strategy with the identity provider's trusted certificate. The supplied evidence does not establish a fixed package version, so consult the project's security advisory for a documented fix or mitigation.

Technical details

Affected software: passport-saml-encryptednpm package by krakenjs

CVE-2026-89042 affects passport-saml-encrypted through 0.1.13. Signature checking is conditional on the optional cert setting, allowing forged SAML responses with attacker-selected NameID and attributes to produce authenticated profiles.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Open in FIRST.org calculator

References

View Original Source