CVE-2026-89042

CVSS 9.3 (critical) · published 2026-09-10

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

Weakness: CWE-347

Source: NVD CVE-2026-89042

References

• https://github.com/krakenjs/passport-saml-encrypted
• https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
• https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
• https://github.com/krakenjs/passport-saml-encrypted/issues/29
• https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.