CVE-2022-39299
Signature bypass via multiple root elements in Passport-SAML
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 4.5% · top 8.5% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.
Weakness
Affected products
- affected < 3.2.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- npm@node-saml/node-samlGHSA-m974-647v-whv7 (opens in a new tab)
- npm@node-saml/passport-samlGHSA-m974-647v-whv7 (opens in a new tab)
- npmnode-samlGHSA-m974-647v-whv7 (opens in a new tab)
- npmpassport-samlGHSA-m974-647v-whv7 (opens in a new tab)
References (3)
- https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 (opens in a new tab)x_transferred
- https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e (opens in a new tab)x_transferred
- http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-m974-647v-whv7 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-39299)Record last updated .