{"id":"GO-2026-6909","summary":"Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml","details":"github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:\n\n1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional \u003csaml:Issuer\u003e element causes a nil-pointer dereference panic after signature verification.\n\n2. Subject uses the bare XML struct tag xml:\"NameID\", which matches \u003cNameID\u003e elements in any XML namespace. When a signed assertion omits \u003csaml:NameID\u003e and includes a \u003cNameID\u003e element in a foreign namespace inside \u003csaml:Subject\u003e, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.","modified":"2026-11-05T23:15:16.667231831Z","published":"2026-11-05T22:55:15Z","database_specific":{"url":"https://pkg.go.dev/vuln/GO-2026-6909","review_status":"REVIEWED"},"references":[{"type":"REPORT","url":"https://github.com/golang/vulndb/issues/6909"}],"affected":[{"package":{"name":"github.com/crewjam/saml","ecosystem":"Go","purl":"pkg:golang/github.com/crewjam/saml"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/crewjam/saml","symbols":["ServiceProvider.ParseResponse","ServiceProvider.ParseXMLArtifactResponse","ServiceProvider.ParseXMLResponse","ServiceProvider.validateAssertion"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6909.json"}}],"schema_version":"1.9.2","credits":[{"name":"Artur Beshkov (aibeshkov)"}]}