samlify vulnerabilities

2 known vulnerabilities in samlify from Tngan. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  samlify: XML Injection

  CVE-2026-46490Jun 8, 2026Tngan

  samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup

• 7.5 High severity

  samlify: Improper Verification of Cryptographic Signature

  CVE-2025-47949May 19, 2025Tngan

  samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the