CVE-2022-39299

Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of `node-saml` before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.

• CWE-347
• CWE-347

• http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlThird Party Advisory, VDB Entry
• https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ePatch, Third Party Advisory
• https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7Third Party Advisory
• http://packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.htmlThird Party Advisory, VDB Entry
• https://github.com/node-saml/passport-saml/commit/8b7e3f5a91c8e5ac7e890a0c90bc7491ce33155ePatch, Third Party Advisory
• https://github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7Third Party Advisory

Published

Oct 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39293Azure RTOS USBX is a high-performance USB host, device, and …9.8
• CVE-2022-39294conduit-hyper integrates a conduit application with the hype…7.5
• CVE-2022-39295Knowage is an open source suite for modern business analytic…6.1
• CVE-2022-39296MelisAssetManager provides deliveries of Melis Platform's as…7.5
• CVE-2022-39297MelisCms provides a full CMS for Melis Platform, including t…9.8
• CVE-2022-39298MelisFront is the engine that displays website hosted on Mel…9.8
• CVE-2022-3930The Directorist WordPress plugin before 7.4.2.2 suffers from…6.5
• CVE-2022-39300node SAML is a SAML 2.0 library based on the SAML implementa…8.1
• CVE-2022-39301sra-admin is a background rights management system that sepa…5.4
• CVE-2022-39302Ree6 is a moderation bot. This vulnerability would allow oth…5.4
• CVE-2022-39303Ree6 is a moderation bot. This vulnerability allows manipula…9.8
• CVE-2022-39304ghinstallation provides transport, which implements http.Rou…4.7