Read the docs
TI-2025-34181 Aliases CVE-2025-54369GHSA-m837-g268-mmv7

Node-SAML SAML Authentication Bypass

Priority MEDIUM 47CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00546 46th percentileScored 2026-11-07
Fix Fixed node-saml (node-saml): 5.1.0@node-saml/node-saml (npm): 5.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-samlnode-samlbefore 5.1.05.1.0Patch availableCNA
—node-saml (npm)up to 3.1.2—No fix listedGHSA-m837-g268-mmv7
—@node-saml/node-saml (npm)before 5.1.05.1.0Patch availableGHSA-m837-g268-mmv7
  • node-saml Vendornode-saml Affected before 5.1.0 Fixed in 5.1.0 Patch available CNA
  • node-saml (npm) Vendor— Affected up to 3.1.2 Fixed in — No fix listed GHSA-m837-g268-mmv7
  • @node-saml/node-saml (npm) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-m837-g268-mmv7

Remediation

  • Fix · CNA node-saml (node-saml) Fixed in 5.1.0
  • Fix · GHSA-m837-g268-mmv7 @node-saml/node-saml (npm) Fixed in 5.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54369
  2. 2026-10-03 Alias added: GHSA-m837-g268-mmv7

References

Advisory 1

Other 4

  • TI-2024-21829 XML signature verification bypass due improper verification of signature / signature spoofing CVSS 3.1CRITICAL 10.0
  • TI-2025-21187 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVSS 4.0CRITICAL 9.3
  • TI-2025-21186 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVSS 4.0CRITICAL 9.3
  • TI-2025-34225 Node-SAML Contains SAML Signature Verification Vulnerability CVSS 3.1CRITICAL 10.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences