Node-saml vulnerabilities
We track 7 vulnerabilities in Node-saml products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on July 28, 2025.
Latest Node-saml vulnerabilities
- 10.0 Critical severity
node-saml: Improper Authentication
A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacke
- 9.3 Critical severity
node-saml: Improper Neutralization of Alternate XSS Syntax
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature
- 9.3 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto f
- 9.3 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an XML digital signature and encryption library for Node.js. An attacker may be able to exploit a vulnerability in versions prior to 6.0.1, 3.2.1, and 2.1.6 to bypass authentication or authorization mechanisms in systems that rely on xml-crypto f
- 10.0 Critical severity
xml-crypto: Improper Verification of Cryptographic Signature
xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610
- 8.1 High severity
node-saml: Improper Verification of Cryptographic Signature
node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP
- 8.1 High severity
passport-saml: Improper Verification of Cryptographic Signature
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession