Read the docs
TI-2025-34225 Aliases CVE-2025-54419GHSA-4mxg-3p6v-xgq3

Node-SAML Contains SAML Signature Verification Vulnerability

Priority MEDIUM 49CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. To conduct the attack an attacker would need a validly signed document from the identity provider (IdP). This is fixed in version 5.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed @node-saml/node-saml (npm): 5.1.0@node-saml/passport-saml (npm): 5.1.0Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
node-samlnode-saml= 5.0.1—No fix listedCNA
—@node-saml/node-saml (npm)before 5.1.05.1.0Patch availableGHSA-4mxg-3p6v-xgq3
—passport-saml (npm)up to 3.2.4—No fix listedGHSA-4mxg-3p6v-xgq3
—@node-saml/passport-saml (npm)before 5.1.05.1.0Patch availableGHSA-4mxg-3p6v-xgq3
  • node-saml Vendornode-saml Affected = 5.0.1 Fixed in — No fix listed CNA
  • @node-saml/node-saml (npm) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-4mxg-3p6v-xgq3
  • passport-saml (npm) Vendor— Affected up to 3.2.4 Fixed in — No fix listed GHSA-4mxg-3p6v-xgq3
  • @node-saml/passport-saml (npm) Vendor— Affected before 5.1.0 Fixed in 5.1.0 Patch available GHSA-4mxg-3p6v-xgq3

Remediation

  • Fix · GHSA-4mxg-3p6v-xgq3 @node-saml/node-saml (npm) Fixed in 5.1.0 Advisory →
  • Fix · GHSA-4mxg-3p6v-xgq3 @node-saml/passport-saml (npm) Fixed in 5.1.0 Advisory →

Red Hat 1 advisory

  • RHSA-2025:14090 Released 2025-08-19 · Red Hat rating Important
    Red Hat Developer Hub 1.7.0 release.
    • Red Hat Developer Hub 1.7 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Developer Hub 1.7Fixed RHSA-2025:14090
Not affected: 2 products
  • Red Hat Developer Hub 1
  • Red Hat Developer Hub 1.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54419
  2. 2026-10-03 Alias added: GHSA-4mxg-3p6v-xgq3
  3. 2026-10-27 Affected versions changed · Red Hat

References

Advisory 1

Other 4

  • TI-2024-21829 XML signature verification bypass due improper verification of signature / signature spoofing CVSS 3.1CRITICAL 10.0
  • TI-2025-21187 xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment CVSS 4.0CRITICAL 9.3
  • TI-2025-21186 xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References CVSS 4.0CRITICAL 9.3
  • TI-2025-34181 Node-SAML SAML Authentication Bypass CVSS 4.0CRITICAL 9.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences