Threat database

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.

CVE-2026-89042 affects the krakenjs passport-saml-encrypted library up to version 0.1.13. The vulnerability allows attackers to bypass authentication by submitting unsigned SAML responses because signature verification depends on an optional certificate configuration. This enables attackers to forge SAML responses with arbitrary user attributes and gain authenticated profiles without valid signatures.