CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-41912
Critical (9.8) in saml project saml. EPSS 2.3% chance of exploitation in the next 30 days. Fixed in github.com/crewjam/saml 0.4.9.
The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.
Severity
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- saml_project:saml
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-j2jp-wvqg-wc2g | Go | github.com/crewjam/saml | <0.4.9 | 0.4.9 |
| GO-2022-1129 | Go | github.com/crewjam/saml | <0.4.9 | 0.4.9 |
References
- http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
- https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b
- https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g
- http://packetstormsecurity.com/files/170356/crewjam-saml-Signature-Bypass.html
- https://github.com/crewjam/saml/commit/aee3fb1edeeaf1088fcb458727e0fd863d277f8b