Search
Find a vulnerability
Search criteria
4 vulnerabilities by krakenjs
CVE-2026-89043 (GCVE-0-2026-89043)
Vulnerability from nvd – Published: 2026-09-10 17:39 – Updated: 2026-09-10 17:53
VLAI
EPSS
VEX
Title
passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
Summary
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:53 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krakenjs/passport-saml-encrypt… | issue-tracking |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypted | product |
| https://www.vulncheck.com/advisories/passport-sam… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krakenjs | passport-saml-encrypted |
Affected:
0 , ≤ 0.1.13
(semver)
|
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89043",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:53:33.236465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:53:56.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/30"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/passport-saml-encrypted",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/passport-saml-encrypted",
"product": "passport-saml-encrypted",
"repo": "https://github.com/krakenjs/passport-saml-encrypted",
"vendor": "krakenjs",
"versions": [
{
"lessThanOrEqual": "0.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:33.458Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Reporter advisory: XML signature wrapping",
"tags": [
"issue-tracking"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/30"
},
{
"name": "Signature located by an unconstrained XPath at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256"
},
{
"name": "Assertion selected by a separate first-match XPath at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328"
},
{
"name": "krakenjs/passport-saml-encrypted",
"tags": [
"product"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted"
},
{
"name": "VulnCheck Advisory: passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending"
}
],
"title": "passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89043",
"datePublished": "2026-09-10T17:39:33.458Z",
"dateReserved": "2026-09-10T16:45:09.299Z",
"dateUpdated": "2026-09-10T17:53:56.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89042 (GCVE-0-2026-89042)
Vulnerability from nvd – Published: 2026-09-10 17:39 – Updated: 2026-09-11 20:32
VLAI
EPSS
VEX
Title
passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
Summary
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:09 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krakenjs/passport-saml-encrypt… | issue-tracking |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypted | product |
| https://www.vulncheck.com/advisories/passport-sam… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krakenjs | passport-saml-encrypted |
Affected:
0 , ≤ 0.1.13
(semver)
|
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:09:27.774740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:56.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/passport-saml-encrypted",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/passport-saml-encrypted",
"product": "passport-saml-encrypted",
"repo": "https://github.com/krakenjs/passport-saml-encrypted",
"vendor": "krakenjs",
"versions": [
{
"lessThanOrEqual": "0.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:32.769Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Reporter advisory: authentication bypass when cert is not configured",
"tags": [
"issue-tracking"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/29"
},
{
"name": "Signature check gated on options.cert at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296"
},
{
"name": "Same gate on the decrypted-assertion path at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321"
},
{
"name": "krakenjs/passport-saml-encrypted",
"tags": [
"product"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted"
},
{
"name": "VulnCheck Advisory: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification"
}
],
"title": "passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89042",
"datePublished": "2026-09-10T17:39:32.769Z",
"dateReserved": "2026-09-10T16:45:04.646Z",
"dateUpdated": "2026-09-11T20:32:56.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89043 (GCVE-0-2026-89043)
Vulnerability from cvelistv5 – Published: 2026-09-10 17:39 – Updated: 2026-09-10 17:53
VLAI
EPSS
VEX
Title
passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending
Summary
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 17:53 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krakenjs/passport-saml-encrypt… | issue-tracking |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypted | product |
| https://www.vulncheck.com/advisories/passport-sam… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krakenjs | passport-saml-encrypted |
Affected:
0 , ≤ 0.1.13
(semver)
|
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89043",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T17:53:33.236465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:53:56.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/30"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/passport-saml-encrypted",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/passport-saml-encrypted",
"product": "passport-saml-encrypted",
"repo": "https://github.com/krakenjs/passport-saml-encrypted",
"vendor": "krakenjs",
"versions": [
{
"lessThanOrEqual": "0.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:33.458Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Reporter advisory: XML signature wrapping",
"tags": [
"issue-tracking"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/30"
},
{
"name": "Signature located by an unconstrained XPath at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256"
},
{
"name": "Assertion selected by a separate first-match XPath at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328"
},
{
"name": "krakenjs/passport-saml-encrypted",
"tags": [
"product"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted"
},
{
"name": "VulnCheck Advisory: passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending"
}
],
"title": "passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89043",
"datePublished": "2026-09-10T17:39:33.458Z",
"dateReserved": "2026-09-10T16:45:09.299Z",
"dateUpdated": "2026-09-10T17:53:56.984Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-89042 (GCVE-0-2026-89042)
Vulnerability from cvelistv5 – Published: 2026-09-10 17:39 – Updated: 2026-09-11 20:32
VLAI
EPSS
VEX
Title
passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
Summary
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 17:09 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/krakenjs/passport-saml-encrypt… | issue-tracking |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypt… | technical-description |
| https://github.com/krakenjs/passport-saml-encrypted | product |
| https://www.vulncheck.com/advisories/passport-sam… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| krakenjs | passport-saml-encrypted |
Affected:
0 , ≤ 0.1.13
(semver)
|
Date Public
2026-08-11 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-89042",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T17:09:27.774740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T20:32:56.136Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/passport-saml-encrypted",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/passport-saml-encrypted",
"product": "passport-saml-encrypted",
"repo": "https://github.com/krakenjs/passport-saml-encrypted",
"vendor": "krakenjs",
"versions": [
{
"lessThanOrEqual": "0.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Yu Bao, PayPal Cyber Security Team"
}
],
"datePublic": "2026-08-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T17:39:32.769Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Reporter advisory: authentication bypass when cert is not configured",
"tags": [
"issue-tracking"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/issues/29"
},
{
"name": "Signature check gated on options.cert at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296"
},
{
"name": "Same gate on the decrypted-assertion path at v0.1.13",
"tags": [
"technical-description"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321"
},
{
"name": "krakenjs/passport-saml-encrypted",
"tags": [
"product"
],
"url": "https://github.com/krakenjs/passport-saml-encrypted"
},
{
"name": "VulnCheck Advisory: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification"
}
],
"title": "passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-89042",
"datePublished": "2026-09-10T17:39:32.769Z",
"dateReserved": "2026-09-10T16:45:04.646Z",
"dateUpdated": "2026-09-11T20:32:56.136Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}