GitHub Advisoryadvisory · Go
GHSA-433w-mm6h-rv9p Auth bypass in SAML provider
CRITICAL
Official page ↗
- Ecosystem
- Go
- Packages
- github.com/netlify/gotrue
- Severity
- Critical
- Reviewed
- 2021-05-21
Affected packages
• Go github.com/netlify/gotrue: < 1.0.0 → fixed in 1.0.0
Description
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:
• `goxmldsig` - Signature Validation Bypass
• `gosaml2` - Authentication Bypass
Patches
Patch available
Please upgrade to v1.0.0 or commit hash `a2b4dd6bc4ef7562d1df044098b303f564eefa90`
Workarounds
No known workarounds.
For more information
If you have any questions or comments about this advisory:
• Open an issue in gotrue
• Email us at [email protected]