GCVE - cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta2:*:*:*:node.js:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:passport-saml_project:passport-saml:4.0.0:beta2:*:*:*:node.js:*:*

part: a version: 4.0.0 update: beta2

Vendor	Passport Saml Project (`15cda368-5023-58b1-a448-126e17be7927`)
Product	Passport Saml (`3ad291b6-1f61-5a57-99c6-6ca8bbd57ac8`)
Edition	*
Language	*
Software edition	*
Target software	node.js
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:bitbucket/sasaki_dev/passport-saml`	purl2cpe	2026-06-01 10:16:30.291464
`pkg:github/node-saml/passport-saml`	purl2cpe	2026-06-01 10:16:30.291466
`pkg:npm/passport-saml`	purl2cpe	2026-06-01 10:16:30.291467

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2022-39299`	vulnerable	2026-06-08 05:47:18.559799	Signature bypass via multiple root elements in Passport-SAML HIGH (7.4) Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround. Published: 2022-10-12T00:00:00.000Z Updated: 2025-04-23T16:51:09.032Z Open on db.gcve.eu Reference links https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7 https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155e http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.