SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-Fed CVE-2025-46572 - May 6, 2025

Description

This vulnerability allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse in Passport-WS-Fed. This can be done by using a valid SAML object that was signed by the configured IdP.

Affected versions

You are affected if you are using passport-wsfed-saml2 version 4.5.1 or below, specifically under the following conditions:

The service provider is using passport-wsfed-saml2
A valid SAML document signed by the Identity Provider can be obtained.

Fix

Upgrade to version 4.6.4 or greater.

CVE details

CVE ID	CVE-2025-46572
Published Date	2025-05-06
Vulnerability Type	SAML Signature Wrapping
CWE	CWE-347 - Improper Verification of Cryptographic Signature
CVSS v4	Score: 9.3 Vector string: https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

SAML Signature Wrapping Vulnerability Leading to User Impersonation