CVE-2025-46572 — Vulnerability in passport-wsfed-saml2 — CVE Details

CRITICAL

Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping

Published May 6, 2025Updated May 6, 2025Source: osv

Summary

### Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. ### Am I Affected? You are affected by this SAML Signature Wrapping vulnerability if you are using `passport-wsfed-saml2` version 4.6.3 or below, specifically under the following conditions: 1. The service provider is using `passport-wsfed-saml2`, 2. A valid SAML document signed by the Identity Provider can be obtained. ### Fix Upgrade to v4.6.4 or greater.

Advisory Timeline

First published May 6, 2025 (524 days ago).
Last revised May 6, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update passport-wsfed-saml2 to 4.6.4 or later

npm install passport-wsfed-saml2@4.6.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

Package	Ecosystem	Affected	Fixed In
passport-wsfed-saml2	npm	All versions	4.6.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-287
Improper AuthenticationMITRE
CWE-347
Improper Verification of Cryptographic SignatureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2025-46572?: Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2025-46572?: CVE-2025-46572 affects passport-wsfed-saml2. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-46572 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-wjmp-wphq-jvqf

Related CVEs

CVE-2026-107722
CRITICAL
fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion
CVE-2026-108261
CRITICAL
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies