samlify versions before 2.13.0 improperly handle XML escaping by only escaping attribute contexts but not element text content. This allows an attacker to inject arbitrary XML elements (e.g., <saml:Attribute>) into signed SAML assertions by injecting XML markup into attribute values such as email or name. Because the IdP signs the tampered assertion and the SP accepts it, the attacker can escalate privileges by injecting unauthorized attributes used for authorization. The vulnerability is classified as CWE-91 (XML Injection). A fix is available in samlify version 2.13.0.

An attacker can inject unauthorized XML attributes into signed SAML assertions, which the Service Provider trusts, leading to privilege escalation. This can compromise authorization mechanisms relying on SAML attributes, potentially granting attackers elevated access or roles within affected systems. There are no known exploits in the wild as of the published date.

Upgrade samlify to version 2.13.0 or later, where this XML Injection vulnerability has been patched. Since this is a library vulnerability, applying the official fix by updating the dependency is the recommended remediation. Patch status is confirmed by the vendor's versioning information.