CVE-2026-89043 Details

A vulnerability exists in the passport-saml-encrypted library, specifically in versions through 0.1.13. This vulnerability involves XML signature wrapping, where the process of signature verification and assertion extraction is flawed. The library uses separate XPath lookups for verification and extraction, without cross-referencing them. As a result, an attacker can prepend a forged, unsigned assertion to a validly signed SAML message. The library will accept the forged assertion as verified, allowing the attacker to impersonate an identity while the genuine signature remains intact.

To address this vulnerability, it is recommended to modify the signature verification process to ensure it is correctly linked to the corresponding assertion extraction. This can be done by resolving the signature reference to the exact element it covers and verifying that it matches the assertion used for profile extraction. Additionally, implement checks to reject documents with duplicate ID attributes and incorporate regression tests for known XML signature wrapping payloads.