Description

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. Users are affected specifically when the service provider is using passport-wsfed-saml2 and a valid SAML document signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.

INFO

Published Date :

2025-05-06T20:18:26.379Z

Last Modified :

2025-05-13T19:17:06.822Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-46572 vulnerability.

Vendors Products
Auth0
  • Passport-wsfed-saml2
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-46572.

URL Resource
https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181 cve-icon cve-icon
https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-wjmp-wphq-jvqf cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability