Authentication Bypass in saml2-js
Summary
GHSA-mfcp-34xw-p57x: Authentication Bypass in saml2-js. Affects saml2-js versions < 2.0.5. Fixed in 2.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The saml2-js package is an npm package used for implementing SAML (Security Assertion Markup Language) authentication in Node.js applications. It provides functionality for generating and validating SAML assertions, which are used for authentication and authorization purposes. However, versions prior to 2.0.5 of saml2-js are vulnerable to an Authentication Bypass.
Vulnerability Detail
The vulnerability in saml2-js arises from the package's failure to enforce the assertion conditions for encrypted assertions. This allows an attacker to reuse encrypted assertion tokens indefinitely, potentially bypassing authentication mechanisms. The impact of this vulnerability can be significant, as it can lead to unauthorized access to sensitive resources or actions within an application.
How To Fix
Latest published version: 4.0.4 as of 23 Oct 2026
npm install saml2-js@4.0.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.5
This is the first release that contains the fix.
npm install saml2-js@2.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The saml2-js package prior to version 2.0.5 is vulnerable to an Authentication Bypass. It is crucial to upgrade to the fixed version to prevent unauthorized access and ensure the security of the application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for saml2-js →
FAQ
The vulnerability allows an attacker to reuse encrypted assertion tokens indefinitely, potentially bypassing authentication mechanisms and gaining unauthorized access to sensitive resources or actions within an application.
To mitigate this vulnerability, it is recommended to upgrade to version 2.0.5 or later of the saml2-js package.
No, there are no known workarounds for this vulnerability. Upgrading to the fixed version is the recommended solution.
No, there is no known exploit code available for this vulnerability at the moment.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-mfcp-34xw-p57x/GHSA-mfcp-34xw-p57x.json
References
Related vulnerabilities
Recent vulnerabilities recorded for saml2-js.
