HMAC-SHA1 Signature Bypass in xml-crypto
Summary
GHSA-c27r-x354-4m68: xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion. Affects xml-crypto versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
xml-crypto is an npm package that provides XML digital signature functionality. It allows users to sign and verify XML documents using various signature algorithms. However, a vulnerability has been discovered in xml-crypto's HMAC-SHA1 signatures, which can be bypassed by exploiting key confusion.
Vulnerability Detail
The vulnerability allows an attacker to inject an HMAC-SHA1 signature that appears valid using only knowledge of the RSA public key. This bypasses the signature validation process, potentially leading to unauthorized access or tampering of XML documents. The issue arises from a flaw in the implementation of the signature validation logic.
How To Fix
Latest published version: 6.4.0 as of 23 Oct 2026
npm install xml-crypto@6.4.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.0.0
This is the first release that contains the fix.
npm install xml-crypto@2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.0.0 is not possible, a temporary workaround is to remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from the SignedXml.SignatureAlgorithms configuration. This will disable the vulnerable HMAC-SHA1 signature algorithm and prevent the bypass. However, this workaround should only be considered as a temporary solution until the package can be upgraded.
Conclusion
The HMAC-SHA1 signature bypass vulnerability in xml-crypto can be mitigated by upgrading to version 2.0.0 or applying the provided workaround. It is important to take action to prevent potential unauthorized access or tampering of XML documents. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for xml-crypto →
FAQ
xml-crypto is an npm package that provides XML digital signature functionality. It allows users to sign and verify XML documents using various signature algorithms.
The vulnerability allows an attacker to bypass signature validation in xml-crypto, potentially leading to unauthorized access or tampering of XML documents.
To fix this vulnerability, it is recommended to upgrade to version 2.0.0 of xml-crypto. This version includes the necessary fixes to prevent the bypass of signature validation.
If upgrading to version 2.0.0 is not possible, a temporary workaround is to remove the 'http://www.w3.org/2000/09/xmldsig#hmac-sha1' entry from the SignedXml.SignatureAlgorithms configuration.
For more information about this vulnerability, you can refer to the advisory on GitHub: [link to advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for xml-crypto.
