Skip to content
Threat Feed
Subscribe

Product

Passport-Saml-Encrypted (<= 0.1.13)

1 brief RSS
critical advisory

Authentication Bypass in passport-saml-encrypted via Unsigned SAML Assertions

The passport-saml-encrypted library versions up to 0.1.13 contain a critical vulnerability where SAML signature verification is skipped if a specific configuration is omitted, allowing attackers to forge and inject arbitrary authentication assertions.

passport-saml-encrypted authentication-bypass saml supply-chain vulnerability cve-2026-89043
2t 1c