Cross-site scripting vulnerability in github.com/crewjam/saml
Summary
CVE-2023-45683: Cross-site scripting via missing binding syntax validation in github.com/crewjam/saml. Affects github.com/crewjam/saml versions < 0.4.14. Fixed in 0.4.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/crewjam/saml is a Go library that provides functionality for working with Security Assertion Markup Language (SAML). SAML is an XML-based standard for exchanging authentication and authorization data between parties. The library allows developers to implement SAML Service Providers (SP) and Identity Providers (IdP) in their applications. However, a vulnerability has been discovered in the package that can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in github.com/crewjam/saml arises from the lack of validation of the ACS Location URI during the parsing of SAML bindings. This allows an attacker to register a malicious Service Provider at the IdP and inject JavaScript code in the ACS endpoint definition. When a SAML Single Sign-On (SSO) flow is initiated, the victim's browser will be redirected to the malicious service provider, resulting in the execution of the injected JavaScript code in the context of the IdP. This can lead to various attacks, such as session hijacking, data theft, or unauthorized actions on behalf of the victim.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.14
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the latest version of github.com/crewjam/saml as soon as possible.
Conclusion
The vulnerability in github.com/crewjam/saml can lead to cross-site scripting (XSS) attacks, allowing attackers to perform unauthorized actions on behalf of victims. It is crucial for developers to update to the latest version of the package (0.4.14 or later) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
github.com/crewjam/saml is a Go library for implementing SAML Service Providers (SP) and Identity Providers (IdP) in applications.
SAML (Security Assertion Markup Language) is an XML-based standard for exchanging authentication and authorization data between parties.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
The consequences of this vulnerability include session hijacking, data theft, and unauthorized actions performed on behalf of the victim.
To protect your application, make sure to update to the latest version of github.com/crewjam/saml (0.4.14 or later) that includes the fix for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
