-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/crewjam/saml | go | < 0.4.9 | 0.4.9 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of multiple Assertion elements in SAML responses. The original implementation in these functions would accept responses if any assertion was properly signed, without validating all assertions. This allowed attackers to include both signed and unsigned assertions, with the service provider potentially accepting the unsigned ones. The commit adds validation loops for both EncryptedAssertion and Assertion elements, enforces signature requirements, and properly handles multiple assertions - indicating these were the vulnerable entry points. The test cases added in the commit specifically target multiple assertion handling in these functions.
A Semantic Attack on Google Gemini - Read the Latest Research