CVE-2026-46490 Details
Description
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups). This issue has been patched in version 2.13.0.
A vulnerability in the samlify library prior to version 2.13.0 allows for XML injection in SAML assertions. The issue arises because the library's template substitution process only escapes attribute contexts, leaving element text values, such as those in <saml:AttributeValue> elements, vulnerable to injection. A normal user can exploit this by injecting XML markup into attribute values and adding new <saml:Attribute> elements into signed assertions. The Identity Provider (IdP) signs the modified assertion, which is then accepted by the Service Provider (SP) as trusted. This injection of attributes can lead to privilege escalation when the injected attributes are used for authorization purposes, such as roles or groups.
Users are advised to update to samlify version 2.13.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m | CISA-ADP | ExploitVendor Advisory |
| https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-91 | XML Injection (aka Blind XPath Injection) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| samlify project samlify | < 2.13.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | New CVE Received | [email protected] |