TI-2026-34189 CVE-2026-46490 · GHSA-34r5-q4jw-r36m
samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions
Priority HIGH 77
samlify is a Node.js library for SAML single sign-on.
Samlify Project
Records3All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Samlify Project records in CISA KEVNo Samlify Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
3 records in Samlify · all components
TI-2025-30342 CVE-2025-47949 · GHSA-r683-v43c-6xqv
samlify SAML Signature Wrapping attack
Priority MEDIUM 49
samlify is a Node.js library for SAML single sign-on.
TI-2017-14663 CVE-2017-1000452 · GHSA-8jjf-w7j6-323c
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in…
Priority LOW 36
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.