CVE-2026-89042
passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
- State
- Published
- Severity
- 9.3 Critical
- Published
- Sep 10, 2026
- Updated
- Sep 11, 2026
- Reserved
- Sep 10, 2026
Description
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-347 Improper Verification of Cryptographic Signature
Affected Products
| Product | Versions |
|---|---|
passport-saml-encryptedkrakenjs |
|
References
- Reporter advisory: authentication bypass when cert is not configuredissue-tracking
- Signature check gated on options.cert at v0.1.13technical-description
- Same gate on the decrypted-assertion path at v0.1.13technical-description
- krakenjs/passport-saml-encryptedproduct
- VulnCheck Advisory: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verificationthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.