CVE-2026-89043
passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
| CWE | CWE-347 |
| Vendor | krakenjs |
| Product | passport-saml-encrypted |
| Published | Sep 10, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for krakenjs passport-saml-encrypted
Be the first to know when new high vulnerabilities affecting krakenjs passport-saml-encrypted are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
krakenjs / passport-saml-encrypted
0 ≤ 0.1.13
References
github.com: https://github.com/krakenjs/passport-saml-encrypted/issues/30 github.com: https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256 github.com: https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328 github.com: https://github.com/krakenjs/passport-saml-encrypted vulncheck.com: https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending
Credits
Yu Bao, PayPal Cyber Security Team