What’s Vulnerable › Vulnerabilities

CVE-2026-89042: passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-10 · updated 2026-09-11
• Weakness: CWE-347

Description

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

Affected products

• krakenjs passport-saml-encrypted: through 0.1.13

References

• https://github.com/krakenjs/passport-saml-encrypted
• https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
• https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
• https://github.com/krakenjs/passport-saml-encrypted/issues/29
• https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification

Get alerted when CVE-2026-89042 or the next vulnerability affects your stack