CVE-2022-41912: crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-11-28 · updated 2026-06-17
Weakness: CWE-287

Description

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

Affected products

crewjam saml: before 0.4.9 — fixed in 0.4.9

How to fix

Upgrade to a fixed version: crewjam saml 0.4.9. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b
https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g
http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b
https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g

Get alerted when CVE-2022-41912 or the next vulnerability affects your stack