CVE-2025-54369
Last modified
CVE-2025-54369 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. EPSS estimates a 0.40% chance of exploitation in the next 30 days.
Description
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-54369?
How severe is CVE-2025-54369?
How do I fix CVE-2025-54369?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54362Rejected reason: Not used
- CVE-2025-54363Microsoft Knack 0.12.0 allows Regular expression Denial of S…6.9
- CVE-2025-54364Microsoft Knack 0.12.0 allows Regular expression Denial of S…6.9
- CVE-2025-54365fastapi-guard is a security library for FastAPI that provide…7.5
- CVE-2025-54366FreeScout is a lightweight free open source help desk and sh…8.8
- CVE-2025-54368uv is a Python package and project manager written in Rust. …6.8
- CVE-2025-5437A vulnerability classified as critical has been found in Mul…6.9
- CVE-2025-54370PhpOffice/PhpSpreadsheet is a pure PHP library for reading a…8.7
- CVE-2025-54371Rejected reason: This CVE is a duplicate of another CVE.
- CVE-2025-54373OpenEMR is a free and open source electronic health records …6.5
- CVE-2025-54374Eidos is an extensible framework for Personal Data Managemen…8.8
- CVE-2025-54376Hoverfly is an open source API simulation tool. In versions …7.5
Are you affected by CVE-2025-54369?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST