-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| passport-saml | npm | < 3.2.2 | 3.2.2 |
| node-saml | npm | < 4.0.0-beta.5 | 4.0.0-beta.5 |
| @node-saml/node-saml | npm | < 4.0.0-beta.5 | 4.0.0-beta.5 |
| @node-saml/passport-saml | npm | < 4.0.0-beta.3 | 4.0.0-beta.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper XML signature validation that didn't enforce a single root element. The commit diff shows the patch added a check for exactly one root element (filtering childNodes.length === 1) in the signature validation flow. The vulnerable version's validateSignature() function in saml.ts only checked the documentElement's signature without verifying the XML structure integrity, enabling signature bypass via multiple roots. The CWE-347 (Improper Signature Verification) directly maps to this function's pre-patch behavior.
A Semantic Attack on Google Gemini - Read the Latest Research