Cross-site Scripting Vulnerability in github.com/crewjam/saml
Summary
CVE-2023-45683: Cross-site Scripting via missing Binding syntax validation. Affects github.com/crewjam/saml versions < 0.4.14. Fixed in 0.4.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The github.com/crewjam/saml package is a Go library that provides functionality for SAML (Security Assertion Markup Language) authentication. It allows applications to act as a SAML Identity Provider (IdP) and handle Single Sign-On (SSO) flows. The package is commonly used in Go applications that require SAML authentication support.
Vulnerability Detail
The package is vulnerable to a cross-site scripting (XSS) attack due to missing validation of the ACS Location URI according to the SAML binding being parsed. This allows attackers to register malicious Service Providers (SPs) at the IdP and inject JavaScript code in the ACS endpoint definition. When a victim's browser loads the SAML IdP initiated SSO link for the malicious SP, the injected JavaScript executes in the IdP context, leading to potential unauthorized actions on behalf of the victim. The severity of this vulnerability is considered high due to the unrestricted nature of SP registration in IdPs.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.14
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, users can perform external validation of URLs provided in SAML metadata to ensure they are secure. Additionally, restricting the ability for end-users to upload arbitrary metadata can help mitigate the risk of XSS attacks.
Conclusion
The github.com/crewjam/saml package is vulnerable to a cross-site scripting (XSS) attack due to missing validation of the ACS Location URI. It is crucial to update to version 0.4.14 or later to mitigate this vulnerability. Perform external validation of URLs in SAML metadata and restrict the upload of arbitrary metadata as additional security measures. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
The impact of this vulnerability is that an attacker can register a malicious Service Provider at the IdP and perform authenticated actions as the victim once the victim's browser loads the SAML IdP initiated SSO link for the malicious SP.
To fix this vulnerability, update the github.com/crewjam/saml package to version 0.4.14 or later.
If updating the package is not immediately feasible, perform external validation of URLs provided in SAML metadata and restrict the ability for end-users to upload arbitrary metadata.
This vulnerability was reported by Francesco Lacerenza from Doyensec.
The severity of this vulnerability is considered high with a CVSS score of 7.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
