BiiTts/CVE-2026-46490-samlify-SAML-Attribute-Injection

PoC

CVE-2026-46490 — samlify <2.13.0 SAML AttributeValue XML injection -> signed-assertion privilege escalation. Self-contained PoC, verified e2e.

view exploit source poc_in_githubauthor BiiTtspublished 2026-06-30catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2026-46490US	high8.8	0.47% (40th)	Exploit	2026-06-08
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.