CVE-2022-39299

Name of the Vulnerable Software and Affected Versions Passport-SAML versions prior to 3.2.2 node-saml versions prior to 4.0.0-beta.5

Description A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks might also be feasible if generation of a signed message can be triggered.

Recommendations For Passport-SAML versions prior to 3.2.2, upgrade to version 3.2.2 or newer. For node-saml versions prior to 4.0.0-beta.5, upgrade to version 4.0.0-beta.5 or newer. As a temporary workaround, consider disabling SAML authentication until a patch is available.