Authentication Bypass in SAML Provider - github.com/netlify/gotrue
Summary
GHSA-433w-mm6h-rv9p: Auth bypass in SAML provider. Affects github.com/netlify/gotrue versions < 1.0.0. Fixed in 1.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/netlify/gotrue is a Go package that provides an authentication and user management system for web applications. It includes support for various authentication providers, including SAML (Security Assertion Markup Language). SAML is an XML-based standard for exchanging authentication and authorization data between parties. This vulnerability affects the SAML authentication provider in the package.
Vulnerability Detail
The SAML authentication provider in github.com/netlify/gotrue is vulnerable to an authentication bypass. The vulnerability includes two specific issues:
-
Signature Validation Bypass in goxmldsig: The goxmldsig library used by github.com/netlify/gotrue does not properly validate XML signatures, allowing an attacker to bypass signature verification and potentially impersonate a valid user.
-
Authentication Bypass in gosaml2: The gosaml2 library used by github.com/netlify/gotrue has a flaw that allows an attacker to bypass authentication and gain unauthorized access to the system.
These vulnerabilities can lead to unauthorized access to user accounts and potentially expose sensitive information.
How To Fix
Latest published version: v1.0.1 as of 23 Oct 2026
go get github.com/netlify/gotrue@v1.0.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.0
This is the first release that contains the fix.
go get github.com/netlify/gotrue@v1.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the patch or upgrade to the fixed version as soon as possible.
Conclusion
The SAML authentication provider in github.com/netlify/gotrue is vulnerable to authentication bypass vulnerabilities. To mitigate the risk, it is crucial to upgrade to version 1.0.0 or apply the commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90. There are no known workarounds for these vulnerabilities, and it is recommended to apply the patch or upgrade to the fixed version as soon as possible. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/netlify/gotrue →
FAQ
These vulnerabilities can allow an attacker to bypass authentication and gain unauthorized access to user accounts. This can lead to potential data breaches and unauthorized actions on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this advisory, there are no known public exploits for these vulnerabilities. However, it is crucial to apply the patch or upgrade to the fixed version to mitigate the risk.
No, there are no known workarounds for these vulnerabilities. It is recommended to apply the patch or upgrade to the fixed version to ensure the security of your application.
For more information, you can open an issue in the gotrue repository at https://github.com/netlify/gotrue/issues or email security@netlify.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/netlify/gotrue.
