{"cve":"CVE-2026-46490","nvd":{"published":"2026-06-08T19:16:45.950","modified":"2026-07-23T08:10:00.137","status":"Analyzed","description":"samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups). This issue has been patched in version 2.13.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-91"],"references":["https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m","https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m"],"products":["samlify_project:samlify"],"source":"nvd","synced_at":"2026-10-19T22:38:48.522727527+00:00"},"epss":{"cve":"CVE-2026-46490","score":0.00469,"percentile":0.40584,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-34r5-q4jw-r36m","url":"https://osv.dev/vulnerability/GHSA-34r5-q4jw-r36m","summary":"samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions","modified":"2026-06-09T13:30:22.458652999Z","packages":[{"ecosystem":"npm","name":"samlify","purl":"pkg:npm/samlify","ranges":["<2.13.0"],"fixed":["2.13.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}