CVSS 4.0
9.9 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:NCVE-2025-47949
Critical (9.9) in samlify project samlify. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in samlify 2.10.0.
samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue.
Severity
CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
- CWE
- CWE-347
- Published
- Modified
- Record from
- the NVD, synced
Affected
- samlify_project:samlify
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r683-v43c-6xqv | npm | samlify | <2.10.0 | 2.10.0 |