10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54419

CVE-2025-54419: Node-SAML SAML Signature Verification Vulnerability

Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature.

This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username.

To conduct the attack an attacker would need a validly signed document from the identity provider (IdP).

In fixing this we made sure to process the SAML assertions from only verified/authenticated contents. This will prevent future variants from coming up.

Note: this is distinct from the previous xml-crypto CVEs.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54419

CVE-2025-54419:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@node-saml/node-saml	npm	= 5.0.1	5.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the application validates the SAML signature but then uses the original, untrusted XML document to extract user information. This is a classic XML signature wrapping vulnerability. An attacker can provide a SAML response where the signature is valid for a certain part of the document, but the application extracts the user's identity from a different, unsigned, and malicious part of the same document.

The patch fixes this by introducing a new function, getVerifiedXml, which, instead of returning a simple boolean, returns the actual XML content that was verified by the signature. The main processing function, SAML.validatePostResponseAsync, was updated to use this new function and to ensure that all subsequent processing is performed only on the verified data.

The key vulnerable functions are SAML.validatePostResponseAsync, which contained the flawed validation logic, and SAML.processValidlySignedAssertionAsync, which consumed the untrusted data. The validateSignature function, while not malicious in itself, was an enabler of the vulnerability due to its insufficient return value, and was therefore deprecated.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.