CVE-2026-89042CWE-347

CVE-2026-89042

Critical · published September 10, 2026

CVSS v3.1
9.1
EPSS
0%
Percentile
31.4
In the wild
Unconfirmed
What it is

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00386 · 31.4th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-10T22:18Z
References (5)
https://github.com/krakenjs/passport-saml-encrypted · [email protected]https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296 · [email protected]https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321 · [email protected]https://github.com/krakenjs/passport-saml-encrypted/issues/29 · [email protected]https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 17:39Z
    passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
    cvelistv5