by Kastro
Paper/Archive/CVE-2026-89042

CVE-2026-89042

krakenjs passport-saml-encrypted — passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

EPSS 0.4%CVSS 9.3
critical.is priorityof 100
34
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 32.7.327 × 206.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

Affected

ProductAffectedFixed inSource
passport-saml-encrypted≤ 0.1.13–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/krakenjs/passport-saml-encrypted/issues/29writeupgithub.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296writeupgithub.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321refgithub.com/krakenjs/passport-saml-encryptedwriteupvulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification