{"id":"CVE-2026-89043","summary":"passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending","details":"passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.","modified":"2026-09-12T03:47:22.682554545Z","published":"2026-09-10T17:39:33.458Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-347"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89043.json"},"references":[{"type":"WEB","url":"https://www.npmjs.com/package/passport-saml-encrypted"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89043.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89043"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending"},{"type":"REPORT","url":"https://github.com/krakenjs/passport-saml-encrypted/issues/30"},{"type":"PACKAGE","url":"https://github.com/krakenjs/passport-saml-encrypted"},{"type":"ARTICLE","url":"https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256"},{"type":"ARTICLE","url":"https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/krakenjs/passport-saml-encrypted","events":[{"introduced":"0"},{"fixed":"1ab28eb11928d66d50af8f231ccb71f7c1923fda"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"0.1.13"},{"fixed":"0.1.13"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v0.1.12","v0.1.13-beta.1","v0.1.11","v0.1.10","v0.1.9","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.1","v0.1.0","v0.0.4","v0.0.3","v0.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89043.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}]}