CVE-2026-89042 in passport-saml-encrypted
Summary
by MITRE • 09/10/2026
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability in passport-saml-encrypted versions through 0.1.13 represents a critical authentication bypass flaw rooted in improper validation of cryptographic integrity within Security Assertion Markup Language (SAML) assertions. SAML is an XML-based standard used for exchanging authentication and authorization data between parties, specifically between an identity provider and a service provider. A core security requirement in this protocol is the verification of digital signatures on SAML responses to ensure that the assertion has not been tampered with during transit and originates from a trusted source. In this specific implementation, the library incorrectly treats signature verification as optional rather than mandatory when certain configuration options are present or absent. This design flaw allows an attacker to submit unsigned SAML responses directly to the Assertion Consumer Service endpoint without triggering any validation errors or rejection mechanisms.
From a technical perspective, the flaw lies in the conditional logic governing the signature verification process. The library checks for the presence of specific certificate configurations and only enforces strict signature validation if those optional parameters are explicitly defined. If an attacker can influence the context such that these options are not present or bypassed, they can construct malicious SAML responses lacking any digital signatures. Because the application does not enforce a global policy requiring signed assertions by default, it accepts these unsigned documents as valid authentication tokens. This effectively nullifies the non-repudiation and integrity guarantees provided by public key infrastructure within the SAML workflow. The attacker crafts a forged response containing arbitrary NameID values and custom attributes, which are then processed by the application as if they were legitimate assertions issued by an authorized identity provider.
The operational impact of this vulnerability is severe, leading to complete authentication bypass. An adversary can impersonate any user or assume administrative privileges simply by posting a crafted unsigned SAML response to the target service. Since the NameID and attributes are arbitrary, attackers can inject specific roles, permissions, or identities that were not originally assigned to them. This compromises the confidentiality of user data, as authenticated sessions are established under false pretenses, and undermines system integrity by allowing unauthorized access to protected resources. In enterprise environments relying on single sign-on solutions, this flaw could allow lateral movement across integrated systems if multiple services share trust relationships with the vulnerable component.
This vulnerability aligns with CWE-287 Improper Authentication, as the software fails to adequately verify credentials or identity assertions before granting access. It also maps to MITRE ATT&CK technique T1652 Impersonation, where an attacker substitutes their own authentication artifacts for those of a legitimate user. To mitigate this risk, organizations must immediately upgrade passport-saml-encrypted to version 0.1.14 or later, which enforces mandatory signature verification regardless of optional configuration settings. Additionally, security architects should implement defense-in-depth strategies by validating SAML responses at the network perimeter using Web Application Firewalls configured to detect unsigned assertions in sensitive endpoints. Regular audits of authentication middleware configurations are essential to ensure that critical security controls like cryptographic validation remain enabled and cannot be inadvertently disabled through misconfiguration or optional parameter manipulation.