Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
History
Fri, 12 Dec 2025 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Reason: This candidate was issued in error. | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0. |
| Title | Node-SAML SAML Authentication Bypass | |
| Weaknesses | CWE-347 CWE-87 |
|
| References |
| |
| Metrics |
cvssV4_0
|
Thu, 24 Jul 2025 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Reason: This candidate was issued in error. |
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-12-12T23:03:52.427Z
Updated: 2025-12-12T23:03:52.427Z
Reserved: 2025-07-21T16:12:20.732Z
Link: CVE-2025-54369
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-07-24T23:15:26.790
Modified: 2025-12-12T23:15:38.447
Link: CVE-2025-54369
Redhat
No data.