CVE-2026-89043
Received Received - Intake

XML Signature Wrapping in Passport-SAML-Encrypted

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-89043
EUVD
EUVD-2026-75632

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
krakenjs passport_saml_encrypted 0.1.13
krakenjs passport_saml_encrypted to 0.1.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-89043 is an XML Signature Wrapping vulnerability in the passport-saml-encrypted library. It allows attackers with a validly signed SAML message to prepend a forged unsigned assertion. The library verifies the signature on the original assertion but extracts identity attributes from the forged unsigned assertion, tricking the system into accepting the attacker's identity.

Detection Guidance

To detect this vulnerability, inspect SAML responses for duplicate assertions or unsigned assertions prepended to valid signed messages. Check if your passport-saml-encrypted library version is 0.1.13 or earlier. Review SAML processing logs for mismatches between signature verification and assertion extraction.

Impact Analysis

This vulnerability enables attackers to impersonate legitimate users by injecting forged identity assertions into SAML messages. If exploited, it could lead to unauthorized access to sensitive systems, data breaches, or privilege escalation. The impact depends on the system's reliance on SAML for authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Immediately upgrade to a patched version of passport-saml-encrypted beyond 0.1.13. If no patch exists, disable SAML authentication or switch to an alternative library. Implement strict validation to ensure the signature's referenced node matches the extracted assertion node and reject documents with duplicate IDs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89043. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart