GitHub Advisoryadvisory · npm

GHSA-mfcp-34xw-p57x Authentication Bypass in saml2-js

MEDIUM Published 2020-09-03 Modified 2021-09-29 Official page ↗
Ecosystem
npm
Packages
saml2-js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287
Reviewed
2020-08-31

Affected packages

• npm saml2-js: < 2.0.5 → fixed in 2.0.5

Description

Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely. Recommendation Upgrade to version 2.0.5 or later.

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References