node-saml xml-crypto up to 2.1.5/3.2.0/6.0.0 XML Digital Signature signature verification

Summaryinfo

A vulnerability categorized as critical has been discovered in node-saml xml-crypto up to 2.1.5/3.2.0/6.0.0. Affected by this issue is some unknown functionality of the component XML Digital Signature Handler. Such manipulation leads to signature verification. This vulnerability is uniquely identified as CVE-2025-29774. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in node-saml xml-crypto up to 2.1.5/3.2.0/6.0.0. It has been rated as critical. Affected by this issue is an unknown functionality of the component XML Digital Signature Handler. The manipulation with an unknown input leads to a signature verification vulnerability. Using CWE to declare the problem leads to CWE-347. The product does not verify, or incorrectly verifies, the cryptographic signature for data. Impacted is confidentiality, integrity, and availability. CVE summarizes:

xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto for verifying signed XML documents. The vulnerability allows an attacker to modify a valid signed XML message in a way that still passes signature verification checks. For example, it could be used to alter critical identity or access control attributes, enabling an attacker with a valid account to escalate privileges or impersonate another user. Users of versions 6.0.0 and prior should upgrade to version 6.0.1 to receive a fix. Those who are still using v2.x or v3.x should upgrade to patched versions 2.1.6 or 3.2.1, respectively.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-29774 since 03/11/2025. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.1.6, 3.2.1 or 6.0.1 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 28f92218ecbb8dcbd238afa4efbbd50302aa9aed is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• node-saml

Name

• xml-crypto

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 3.0
• 3.1
• 3.2.0
• 6.0

License

• open-source

Website

• Product: https://github.com/node-saml/xml-crypto/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion