TI-2022-07564 Aliases CVE-2022-23505 GHSA-ppjq-qxhx-m25f

Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication

MEDIUM 40CWE-287Published 2022-12-13 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.008 56th percentileScored 2026-11-07

Fix Fixed passport-wsfed-saml2 (auth0): 4.6.3passport-wsfed-saml2 (npm): 4.6.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	passport-wsfed-saml2	before 4.6.3	4.6.3	Patch available	CNA
—	passport-wsfed-saml2 (npm)	before 4.6.3	4.6.3	Patch available	GHSA-ppjq-qxhx-m25f

passport-wsfed-saml2 Vendorauth0 Affected before 4.6.3 Fixed in 4.6.3 Patch available CNA
passport-wsfed-saml2 (npm) Vendor— Affected before 4.6.3 Fixed in 4.6.3 Patch available GHSA-ppjq-qxhx-m25f

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:passport-wsfed-saml2::::::::	up to 4.6.2	Vulnerable	auth0

cpe:2.3:a:auth0:passport-wsfed-saml2:*:*:*:*:*:*:*:* Versions up to 4.6.2 Vulnerable ·auth0

Remediation

Fix · CNA passport-wsfed-saml2 (auth0) Fixed in 4.6.3
Fix · GHSA-ppjq-qxhx-m25f passport-wsfed-saml2 (npm) Fixed in 4.6.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-23505
2026-10-03 Alias added: GHSA-ppjq-qxhx-m25f

References

Advisory 2

Other 2

TI-2017-12439 A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting… CVSS 3.0HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences