The vulnerability in passport-saml-encrypted versions up to 0.1.13 arises because the software makes SAML signature verification conditional on the presence of an optional certificate option. Attackers can exploit this by submitting unsigned SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint, effectively bypassing authentication and gaining unauthorized access with forged profiles. The CVSS 4.0 score of 9.3 reflects the critical nature of this remote, unauthenticated vulnerability with high impact on confidentiality and integrity.

Successful exploitation allows attackers to bypass authentication controls by submitting unsigned and forged SAML responses, resulting in unauthorized access to authenticated profiles. This compromises the confidentiality and integrity of user authentication, potentially allowing attackers to impersonate legitimate users without valid credentials.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid relying on passport-saml-encrypted versions up to 0.1.13 for authentication or implement additional verification controls to ensure SAML response signatures are validated regardless of optional certificate settings.