CVE-2022-41912: Authentication bypass in github.com/crewjam/saml
Summary
CVE-2022-41912: Authentication bypass in github.com/crewjam/saml. Affects github.com/crewjam/saml versions < 0.4.9. Fixed in 0.4.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/crewjam/saml is a Go library that provides functionality for processing SAML (Security Assertion Markup Language) responses. It is commonly used in applications that implement SAML-based authentication and authorization. The package includes various functions for parsing and validating SAML responses, as well as handling logout requests. However, a vulnerability has been discovered in the package that allows for authentication bypass when processing SAML responses containing multiple Assertion elements.
Vulnerability Detail
The vulnerability in github.com/crewjam/saml allows an attacker to bypass authentication by exploiting the way the package handles SAML responses. By crafting a malicious SAML response with multiple Assertion elements, an attacker can trick the package into considering the authentication process as successful, even if the provided credentials are invalid. This can lead to unauthorized access to protected resources and compromise the security of the application. The vulnerability was discovered by Felix Wilhelm from Google Project Zero.
How To Fix
Latest published version: v0.5.1 as of 23 Oct 2026
go get github.com/crewjam/saml@v0.5.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.9
This is the first release that contains the fix.
go get github.com/crewjam/saml@v0.4.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The github.com/crewjam/saml package is vulnerable to an authentication bypass issue when processing SAML responses containing multiple Assertion elements. To mitigate this vulnerability, it is crucial to update the package to version 0.4.9 or later. Developers should also ensure that their applications are using the latest version of the package and retest the authentication functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/crewjam/saml →
FAQ
The vulnerability allows an attacker to bypass authentication in applications that use the github.com/crewjam/saml package. This can lead to unauthorized access to protected resources and compromise the security of the application.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file and the playground will analyze it for any open-source vulnerabilities, including this one.
At the moment, there are no known workarounds for this vulnerability. It is recommended to update the github.com/crewjam/saml package to the latest version to mitigate the issue.
There is no evidence of this vulnerability being exploited in the wild at the moment. However, it is important to update the package to the latest version to prevent any potential attacks.
The vulnerability was discovered by Felix Wilhelm from Google Project Zero.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/crewjam/saml.
