passport-saml-encrypted vulnerabilities

2 known vulnerabilities in passport-saml-encrypted from Krakenjs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.4 High severity

  passport-saml-encrypted: Improper Verification of Cryptographic Signature

  CVE-2026-89043Sep 10, 2026Krakenjs

  passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend

• 9.1 Critical severity

  passport-saml-encrypted: Improper Verification of Cryptographic Signature

  CVE-2026-89042Sep 10, 2026Krakenjs

  passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID a