-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| passport-wsfed-saml2 | npm | < 4.6.3 | 4.6.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper assertion validation in WS-Fed token processing. The GitHub PR #179 shows the fix adds a check for exactly one Assertion element. Prior to 4.6.3, the library would process the first assertion without validating the count, enabling bypass if an attacker provided multiple assertions. The file path and vulnerability pattern match the CWE-287 (Improper Authentication) description, and the patch directly addresses this by adding assertion count validation.