Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:passport-Saml-Encrypted:passport-Saml-Encrypted:*:*:*:*:*:*:*:*

1 brief RSS
critical advisory

Authentication Bypass in passport-saml-encrypted via Unsigned SAML Assertions

The passport-saml-encrypted library versions up to 0.1.13 contain a critical vulnerability where SAML signature verification is skipped if a specific configuration is omitted, allowing attackers to forge and inject arbitrary authentication assertions.

passport-saml-encrypted authentication-bypass saml supply-chain vulnerability cve-2026-89043
2t 1c