CVE-2026-89043 — passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with …
Published: 2026-09-10 · CVSS: 9.1 · CVSS 4.0
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7