N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-46573

CVE-2025-46573: Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling

Overview

This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response.

Am I Affected?

You are affected by this SAML Attribute Smuggling vulnerability if you are using passport-wsfed-saml2 version 4.6.3 or below, specifically under the following conditions:

The service provider is using passport-wsfed-saml2,
A valid SAML Response signed by the Identity Provider can be obtained

Fix

Upgrade to v4.6.4 or greater.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-46573

CVE-2025-46573:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
passport-wsfed-saml2	npm	>= 3.0.5, <= 4.6.3	4.6.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows attribute smuggling by tampering with a SAML response. This implies that the parsing mechanism for SAML assertions was not strictly isolating the legitimate assertion from potentially injected ones. The provided patch addresses this by modifying XPath queries in key functions to be highly specific, ensuring that only the first 'Assertion' element (and its children) within the first 'Response' element is processed.

Samlp.extractAssertion is the initial point where the assertion is pulled from the larger SAML response. If it could be tricked into picking a smuggled assertion, the vulnerability would propagate. The patch makes its XPath selectors more specific (Response[1]/Assertion[1]).
SAML.parseAssertion is responsible for the detailed parsing of the already extracted (and hopefully validated) assertion. This function and its various helper methods (like getAttributes, getNameID20, etc.) were updated to use XPath queries that explicitly target elements within the first Assertion (Assertion[1]). This prevents these helpers from accidentally reading data from a second, smuggled Assertion element that might have been appended to the XML structure.

The core of the fix lies in ensuring that any XPath query or selection logic that deals with 'Assertion' elements is scoped to the first such element encountered, mitigating the risk of processing attacker-injected attributes from a secondary, smuggled 'Assertion' element.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.