Read the docs
TI-2017-12439 Aliases CVE-2017-16897GHSA-77fw-rf4v-vfp9

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting…

Priority LOW 38CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-290.

Summary

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).

Why it matters now

EPSS 0.01378 72nd percentileScored 2026-11-07
Fix Fixed passport-wsfed-saml2 (npm): 3.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—passport-wsfed-saml2 (npm)before 3.0.53.0.5Patch availableGHSA-77fw-rf4v-vfp9
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • passport-wsfed-saml2 (npm) Vendor— Affected before 3.0.5 Fixed in 3.0.5 Patch available GHSA-77fw-rf4v-vfp9

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:auth0:passport-wsfed-saml2:*:*:*:*:*:*:*:*before 3.0.5Vulnerableauth0
  • cpe:2.3:a:auth0:passport-wsfed-saml2:*:*:*:*:*:*:*:* Versions before 3.0.5 Vulnerable ·auth0

Remediation

  • Fix · GHSA-77fw-rf4v-vfp9 passport-wsfed-saml2 (npm) Fixed in 3.0.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-16897
  2. 2026-10-03 Alias added: GHSA-77fw-rf4v-vfp9

References

Advisory 2

Other 3

  • TI-2022-07564 Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences