CVE-2026-89043
passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.
- Published Sep 10, 2026
- CVSS 9.1 critical
- 0.3% chance of exploitation in the next 30 days (EPSS)