A critical authentication bypass in the npm package passport-saml-encrypted (through version 0.1.13) lets unauthenticated attackers forge SAML responses and log in as any user, because signature verification only runs when an optional cert option happens to be set.
What Is It
passport-saml-encrypted makes SAML signature verification conditional on an optional cert configuration option. When that option is absent, the library accepts SAML responses without validating signatures at all. An attacker can POST a forged, unsigned SAML response, with an arbitrary NameID and arbitrary attributes, directly to the application's assertion consumer service (ACS) endpoint and receive an authenticated profile in return.
The flaw is classified as CWE-347 (Improper Verification of Cryptographic Signature). It carries a CVSS 3.1 base score of 9.1 (Critical) (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and a CVSS 4.0 score of 9.3 (Critical).
Why It Matters
This is a complete pre-authentication bypass of the identity layer. The attack is network-reachable, requires no privileges, no user interaction, and low complexity; the attacker only needs to reach the ACS endpoint. Because the attacker controls the NameID and attribute set in the forged response, they choose which identity to assume, including administrative accounts if the application maps roles from SAML attributes. Confidentiality and integrity impact are both rated HIGH.
SAML libraries sit in front of everything else, so a bypass here nullifies downstream access controls that trust the authenticated session.
What's Vulnerable
- Vendor: krakenjs
- Product:
passport-saml-encrypted(npm,pkg:npm/passport-saml-encrypted) - Affected versions: all versions through 0.1.13 (semver
<= 0.1.13)
The vulnerable logic is identified in lib/saml.js at lines 296 and 321 in the v0.1.13 tree.
Patch Status
No fixed version or vendor patch is identified in the supplied NVD record; the CVE's vulnStatus is listed as Deferred. This CVE does not appear in the CISA KEV catalog in the supplied data, so there is no KEV-confirmed active exploitation and no federal required-action deadline associated with it.
Sources
- NVD, CVE-2026-89042 (source:
[email protected], published 2026-09-10) - VulnCheck Advisory, passport-saml-encrypted through 0.1.13 authentication bypass via missing signature verification
- GitHub, krakenjs/passport-saml-encrypted
- GitHub Issue #29, krakenjs/passport-saml-encrypted/issues/29
- Affected code, lib/saml.js#L296, lib/saml.js#L321