passport-saml-encrypted Vulnerability: Critical CVE-2026-89042 Alert
- Severity
- CRITICAL
- CVSS
- 9.1
- Affected component
- passport-saml-encrypted (npm)
- Affected versions
- >= v0.1.12, <= v0.1.12 or >= v0.1.13, <= v0.1.13 or >= v0.1.13-beta.1, <= v0.1.13-beta.1 or >= v0.1.11, <= v0.1.11 or >= v0.1.10, <= v0.1.10 or >= v0.1.9, <= v0.1.9 or >= v0.1.6, <= v0.1.6 or >= v0.1.5, <= v0.1.5 or >= v0.1.4, <= v0.1.4 or >= v0.1.3, <= v0.1.3 or >= v0.1.1, <= v0.1.1 or >= v0.1.0, <= v0.1.0 or >= v0.0.4, <= v0.0.4 or >= v0.0.3, <= v0.0.3 or >= v0.0.2, <= v0.0.2
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the passport-saml-encrypted npm package. This vulnerability, tracked as CVE-2026-89042, could allow attackers to bypass authentication by submitting unsigned SAML responses.
What happened
Reportedly, passport-saml-encrypted through version 0.1.13 makes SAML signature verification conditional on an optional certificate option. This design choice allows attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures. This vulnerability is under investigation and has not yet been exploited in the wild.
The affected versions of passport-saml-encrypted are extensive, spanning from version 0.0.2 up to and including version 0.1.13 and its beta releases. The vulnerability appears to affect all versions of the package, as detailed in the provided source data.
What to do about it
- Upgrade passport-saml-encrypted to a version that enforces SAML signature verification.
- Review your application's configuration to ensure that SAML signature verification is not made conditional on optional settings.
- Monitor the primary sources for updates on patched versions and further details.
- Consider implementing additional authentication checks as a temporary measure until a patched version is available.
- Notify your security team and stakeholders about the potential risk and the steps being taken to mitigate it.
How 0Day would have caught this
passport-saml-encrypted is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are reportedly affected if you are using passport-saml-encrypted in versions ranging from 0.0.2 up to and including 0.1.13 and its beta releases.
What should I do right now?
Immediately upgrade passport-saml-encrypted to a version that enforces SAML signature verification. Review your application's configuration and consider implementing additional authentication checks as a temporary measure.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates on patched versions.
How severe is this vulnerability?
This vulnerability is classified as CRITICAL with a CVSS score of 9.1.