CVE-2022-39300
highpriority · track · 32EPSS 0.008 · 55 %ileEUUSEPSS · scored 2026-10-24
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (4)
Products and version ranges known to be affected.
advisories (1)
Vendor and ecosystem advisories describing this.
- GHSA-5p8w-2mvw-38pvSignature bypass via multiple root elements2022-10-12ghsa · osvUS
### Impact A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. ### Patches Users should upgrade to node-saml v4.0.0-beta5 or newer. ### Workarounds Disable SAML authentication. ### References _Are there any links users can visit to find out more?_ ### For more information If you have any questions or comments about this advisory: * Open a discussion in the [node-saml repo](https://github.com/node-saml/node-saml/discussions) ### Credits * Felix Wilhelm of Google Project Zero
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2022-39300/cnnvd
- https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbecnnvd
- https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pvcnnvd
- https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbeenisa_euvd
- https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pvenisa_euvd
- https://github.com/node-saml/node-saml/commit/c1f275c289c01921e58f5c70ce0fdbc5287e5fbePatchThird Party Advisorynvd
- https://github.com/node-saml/node-saml/security/advisories/GHSA-5p8w-2mvw-38pvThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan