CVE-2026-89042

passport-saml-encrypted through 0.1.13 (CWE-347, improper verification of cryptographic signature) only verifies SAML response signatures when the optional 'cert' option is configured, so applications that omit it accept unsigned assertions. An attacker can send a forged, unsigned SAML response with an arbitrary NameID and attributes directly to the application's assertion consumer service (ACS) endpoint. This yields an authenticated profile as a user of the attacker's choosing, bypassing the identity provider and granting a valid application session; CVSS 4.0 rates the issue 9.3 (critical) with network attack vector, no privileges or user interaction required. Any Node.js application using passport-saml-encrypted without a configured cert option is affected, while deployments that set cert enforce signature verification and are not exposed to this bypass. No public proof of concept is known, the flaw is not in CISA KEV, and there are no reports of exploitation in the wild.

What to do: Audit your passport-saml-encrypted strategy configuration: if the cert option is not set, add the identity provider's signing certificate so signatures are enforced, or move to a patched release when one becomes available (the available data lists no fixed version above 0.1.13). Applications that cannot set cert should consider migrating to an actively maintained SAML library. Also review ACS endpoint logs for unsigned or anomalous SAML responses that could indicate forged logins.