Read the docs
TI-2022-18676 Aliases CVE-2022-39300GHSA-5p8w-2mvw-38pv

Signature bypass via multiple root elements in node-SAML

Priority LOW 39CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

node SAML is a SAML 2.0 library based on the SAML implementation of passport-saml. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to node-saml version 4.0.0-beta5 or newer. Disabling SAML authentication may be done as a workaround.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00782 56th percentileScored 2026-11-07
Fix Fixed node-saml (node-saml): 4.0.0-beta.5node-saml (npm): 4.0.0-beta.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-samlnode-samlbefore 4.0.0-beta.54.0.0-beta.5Patch availableCNA
—node-saml (npm)before 4.0.0-beta.54.0.0-beta.5Patch availableGHSA-5p8w-2mvw-38pv
  • node-saml Vendornode-saml Affected before 4.0.0-beta.5 Fixed in 4.0.0-beta.5 Patch available CNA
  • node-saml (npm) Vendor— Affected before 4.0.0-beta.5 Fixed in 4.0.0-beta.5 Patch available GHSA-5p8w-2mvw-38pv

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:node_saml_project:node_saml:*:*:*:*:*:node.js:*:*before 4.0.0VulnerableNode Saml Project
cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta0:*:*:*:node.js:*:*4.0.0 beta0VulnerableNode Saml Project
cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta1:*:*:*:node.js:*:*4.0.0 beta1VulnerableNode Saml Project
cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta2:*:*:*:node.js:*:*4.0.0 beta2VulnerableNode Saml Project
cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta3:*:*:*:node.js:*:*4.0.0 beta3VulnerableNode Saml Project
cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta4:*:*:*:node.js:*:*4.0.0 beta4VulnerableNode Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:*:*:*:*:*:node.js:*:* Versions before 4.0.0 Vulnerable ·Node Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta0:*:*:*:node.js:*:* Versions 4.0.0 beta0 Vulnerable ·Node Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta1:*:*:*:node.js:*:* Versions 4.0.0 beta1 Vulnerable ·Node Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta2:*:*:*:node.js:*:* Versions 4.0.0 beta2 Vulnerable ·Node Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta3:*:*:*:node.js:*:* Versions 4.0.0 beta3 Vulnerable ·Node Saml Project
  • cpe:2.3:a:node_saml_project:node_saml:4.0.0:beta4:*:*:*:node.js:*:* Versions 4.0.0 beta4 Vulnerable ·Node Saml Project

Remediation

  • Fix · CNA node-saml (node-saml) Fixed in 4.0.0-beta.5
  • Fix · GHSA-5p8w-2mvw-38pv node-saml (npm) Fixed in 4.0.0-beta.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39300
  2. 2026-10-03 Alias added: GHSA-5p8w-2mvw-38pv
  3. 2026-10-06 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 1

  • TI-2024-21829 XML signature verification bypass due improper verification of signature / signature spoofing CVSS 3.1CRITICAL 10.0
  • TI-2025-21187 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVSS 4.0CRITICAL 9.3
  • TI-2025-21186 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVSS 4.0CRITICAL 9.3
  • TI-2025-34225 Node-SAML Contains SAML Signature Verification Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2025-34181 Node-SAML SAML Authentication Bypass CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences