Authentication Bypass in passport-saml-encrypted via Unsigned SAML Assertions

CVE-2026-89042 affects the passport-saml-encrypted library through version 0.1.13. The vulnerability stems from an insecure implementation of SAML signature verification logic, where the library makes the verification process conditional based on an optional 'cert' configuration parameter. When this parameter is absent or misconfigured, the library fails to validate the signature of the SAML response. This design flaw allows a remote, unauthenticated attacker to inject forged SAML responses directly into the application's Assertion Consumer Service (ACS) endpoint. By providing an unsigned assertion containing arbitrary 'NameID' fields and malicious user attributes, the attacker can successfully impersonate any user within the target system, bypassing primary authentication mechanisms. The severity is elevated due to the ease of exploitation and the direct impact on system-wide access control.

Impact

Successful exploitation allows for full authentication bypass, leading to unauthorized account access and potential privilege escalation within applications utilizing this library. The vulnerability affects any service relying on passport-saml-encrypted for SAML-based identity federation. Given the nature of SAML assertions, an attacker can craft assertions to match any existing user ID, posing a severe risk to multi-tenant or enterprise environments.

Recommendation

1. Patch immediately by upgrading the passport-saml-encrypted dependency to a version higher than 0.1.13.
2. Audit all application configurations utilizing this library to ensure that the optional 'cert' validation parameter is explicitly enabled and properly configured.
3. Review application authentication logs for anomalous SAML response submissions that lack corresponding signature metadata or originate from unexpected sources.