Read the docs
TI-2022-18675 Aliases CVE-2022-39299GHSA-m974-647v-whv7

Signature bypass via multiple root elements in Passport-SAML

Priority MEDIUM 45CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04494 91st percentileScored 2026-11-07
Fix Fixed passport-saml (node-saml): 3.2.2passport-saml (npm): 3.2.2+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-samlpassport-samlbefore 3.2.23.2.2Patch availableCNA
—passport-saml (npm)before 3.2.23.2.2Patch availableGHSA-m974-647v-whv7
—node-saml (npm)before 4.0.0-beta.54.0.0-beta.5Patch availableGHSA-m974-647v-whv7
—@node-saml/node-saml (npm)before 4.0.0-beta.54.0.0-beta.5Patch availableGHSA-m974-647v-whv7
—@node-saml/passport-saml (npm)before 4.0.0-beta.34.0.0-beta.3Patch availableGHSA-m974-647v-whv7
  • passport-saml Vendornode-saml Affected before 3.2.2 Fixed in 3.2.2 Patch available CNA
  • passport-saml (npm) Vendor— Affected before 3.2.2 Fixed in 3.2.2 Patch available GHSA-m974-647v-whv7
  • node-saml (npm) Vendor— Affected before 4.0.0-beta.5 Fixed in 4.0.0-beta.5 Patch available GHSA-m974-647v-whv7
  • @node-saml/node-saml (npm) Vendor— Affected before 4.0.0-beta.5 Fixed in 4.0.0-beta.5 Patch available GHSA-m974-647v-whv7
  • @node-saml/passport-saml (npm) Vendor— Affected before 4.0.0-beta.3 Fixed in 4.0.0-beta.3 Patch available GHSA-m974-647v-whv7

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:passport-saml_project:passport-saml:*:*:*:*:*:node.js:*:*before 3.2.2VulnerablePassport-saml Project
cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta1:*:*:*:node.js:*:*4.0.0 beta1VulnerablePassport-saml Project
cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta2:*:*:*:node.js:*:*4.0.0 beta2VulnerablePassport-saml Project
cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta3:*:*:*:node.js:*:*4.0.0 beta3VulnerablePassport-saml Project
cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta4:*:*:*:node.js:*:*4.0.0 beta4VulnerablePassport-saml Project
  • cpe:2.3:a:passport-saml_project:passport-saml:*:*:*:*:*:node.js:*:* Versions before 3.2.2 Vulnerable ·Passport-saml Project
  • cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta1:*:*:*:node.js:*:* Versions 4.0.0 beta1 Vulnerable ·Passport-saml Project
  • cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta2:*:*:*:node.js:*:* Versions 4.0.0 beta2 Vulnerable ·Passport-saml Project
  • cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta3:*:*:*:node.js:*:* Versions 4.0.0 beta3 Vulnerable ·Passport-saml Project
  • cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta4:*:*:*:node.js:*:* Versions 4.0.0 beta4 Vulnerable ·Passport-saml Project

Remediation

  • Fix · CNA passport-saml (node-saml) Fixed in 3.2.2
  • Fix · GHSA-m974-647v-whv7 passport-saml (npm) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-m974-647v-whv7 node-saml (npm) Fixed in 4.0.0-beta.5 Advisory →
  • Fix · GHSA-m974-647v-whv7 @node-saml/node-saml (npm) Fixed in 4.0.0-beta.5 Advisory →
  • Fix · GHSA-m974-647v-whv7 @node-saml/passport-saml (npm) Fixed in 4.0.0-beta.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39299
  2. 2026-10-03 Alias added: GHSA-m974-647v-whv7
  3. 2026-10-09 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 3

Other 2

  • TI-2024-21829 XML signature verification bypass due improper verification of signature / signature spoofing CVSS 3.1CRITICAL 10.0
  • TI-2025-21187 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVSS 4.0CRITICAL 9.3
  • TI-2025-21186 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVSS 4.0CRITICAL 9.3
  • TI-2025-34225 Node-SAML Contains SAML Signature Verification Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2025-34181 Node-SAML SAML Authentication Bypass CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences