CVE-2026-89043criticalCWE-347

CVE-2026-89043: falha crítica em krakenjs passport-saml-encrypted

passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion Prepending

Publicada em

Seguir esta CVE+ Monitorar passport-saml-encrypted

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.3%
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
krakenjs · passport-saml-encrypted
CVEs relacionadas — krakenjs passport-saml-encrypted

No mesmo produto, das mais perigosas para as menos.

CVE-2026-89042CRITICALpassport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature VerificationEPSS 0.4%