CVE-2022-41912

—

CVSS 3.1

9.8 critical

EPSS

2%p82

Published

Nov 28, 2022 (Nov 28, 2022)

Modified

Jun 17, 2026

Description

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

Vendors: saml project
Products: saml
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.2%)

In the news0 stories

No ingested article mentions this CVE yet.