CVE-2026-46490: samlify XML Injection Vulnerability Leading to Privilege Escalation
Summary
CVE-2026-46490: samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions. Affects samlify versions < 2.13.0. Fixed in 2.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
samlify is a popular library used for implementing SAML (Security Assertion Markup Language) authentication in Node.js applications. It facilitates the creation and parsing of SAML assertions, allowing for secure communication between identity providers (IdPs) and service providers (SPs). The library is designed to streamline the integration of SAML-based authentication, making it easier for developers to manage user identities and access control. However, a critical vulnerability has been identified that allows for XML injection in signed SAML assertions, potentially leading to unauthorized privilege escalation.
Vulnerability Detail
The vulnerability arises from samlify's template substitution mechanism, which fails to properly escape values inserted into element text, specifically within saml:AttributeValue elements. This oversight allows a malicious user to inject arbitrary XML markup into attribute values, such as email or name, thereby creating new saml:Attribute elements within the signed assertion. When the identity provider (IdP) signs this tampered assertion, the service provider (SP) accepts the injected attributes as trusted. This can lead to privilege escalation in systems that rely on SAML attributes for authorization, allowing attackers to gain elevated access rights.
How To Fix
Minimum fixed version
2.13.0
This is the first release that contains the fix.
npm install samlify@2.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization on user-provided attribute values before they are processed by samlify. This can help mitigate the risk of XML injection until the package is updated. Additionally, consider using a different library for SAML assertions that has robust security measures in place.
Conclusion
CVE-2026-46490 is a significant vulnerability in the samlify package that can lead to privilege escalation through XML injection in SAML assertions. It is crucial for developers using this library to update to version 2.13.0 or later to mitigate the risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for samlify →
FAQ
CVE-2026-46490 is a vulnerability in the samlify package that allows for XML injection in signed SAML assertions, potentially leading to privilege escalation.
If your application uses samlify for SAML authentication, this vulnerability could allow unauthorized users to gain elevated privileges by injecting malicious attributes into SAML assertions.
Implement input validation and sanitization on user-provided attribute values as a temporary workaround until you can update to the patched version.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for CVE-2026-46490 is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for samlify.
