CVE-2026-89043

CVE-2026-89043 is an XML signature wrapping flaw (CWE-347) in the passport-saml-encrypted Node.js (npm) package: the code that verifies the XML signature and the code that extracts the SAML assertion perform independent XPath lookups with no cross-validation that they reference the same element. Because the signature check can pass against the original, genuinely signed assertion while the identity is read from an attacker-supplied element, an attacker holding any validly signed SAML message — for example, a response issued for their own legitimate login — can prepend a forged, unsigned assertion naming a victim and be accepted as that user. This yields unauthenticated impersonation of arbitrary users at any service provider relying on the package, with high confidentiality and integrity impact and no availability impact (CVSS 4.0 score 9.1, Critical); no stolen keys or passwords are required. All versions through and including 0.1.13 are affected, so any Node.js application using passport-saml-encrypted for SAML single sign-on is in scope. No public proof-of-concept is known and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation is not confirmed, though the low complexity of the attack once a signed message is obtained means it should not be ruled out.

What to do: Upgrade passport-saml-encrypted to a patched release beyond 0.1.13 as soon as one is available; until then, where configuration allows, require signed assertions and take the authenticated identity from the same XML element whose signature is validated. Check identity-provider and application authentication logs for unexplained SSO logins, since an attacker needs only any validly signed SAML message (for example, one issued for their own legitimate login) to impersonate an arbitrary user.