{"cve":"CVE-2023-45683","nvd":{"published":"2023-10-16T19:15:11.253","modified":"2026-06-17T06:29:21.597","status":"Modified","description":"github.com/crewjam/saml is a saml library for the go language. In affected versions the package does not validate the ACS Location URI according to the SAML binding being parsed. If abused, this flaw allows attackers to register malicious Service Providers at the IdP and inject Javascript in the ACS endpoint definition, achieving Cross-Site-Scripting (XSS) in the IdP context during the redirection at the end of a SAML SSO Flow. Consequently, an attacker may perform any authenticated action as the victim once the victim’s browser loaded the SAML IdP initiated SSO link for the malicious service provider. Note: SP registration is commonly an unrestricted operation in IdPs, hence not requiring particular permissions or publicly accessible to ease the IdP interoperability. This issue is fixed in version 0.4.14. Users unable to upgrade may perform external validation of URLs provided in SAML metadata, or restrict the ability for end-users to upload arbitrary metadata.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79","https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5","https://github.com/crewjam/saml/commit/b07b16cf83c4171d16da4d85608cb827f183cd79","https://github.com/crewjam/saml/security/advisories/GHSA-267v-3v32-g6q5"],"products":["saml_project:saml"],"source":"nvd","synced_at":"2026-10-19T21:39:34.467980132+00:00"},"epss":{"cve":"CVE-2023-45683","score":0.00485,"percentile":0.41752,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-267v-3v32-g6q5","url":"https://osv.dev/vulnerability/GHSA-267v-3v32-g6q5","summary":"Cross-site Scripting via missing Binding syntax validation","modified":"2026-09-10T03:50:03.374675616Z","packages":[{"ecosystem":"Go","name":"github.com/crewjam/saml","purl":"pkg:golang/github.com/crewjam/saml","ranges":["<0.4.14"],"fixed":["0.4.14"]}]},{"id":"GO-2023-2114","url":"https://osv.dev/vulnerability/GO-2023-2114","summary":"Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml","modified":"2024-05-20T16:03:47Z","packages":[{"ecosystem":"Go","name":"github.com/crewjam/saml","purl":"pkg:golang/github.com/crewjam/saml","ranges":["<0.4.14"],"fixed":["0.4.14"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}