Node-SAML SAML Signature Verification Vulnerability

The core of this vulnerability lies in how @node-saml/node-saml handles SAML assertions. Instead of exclusively relying on verified, signed components, it loads data from the original, unsigned response document. This discrepancy allows an attacker, possessing a validly signed SAML document from the Identity Provider (IdP), to modify the assertion's contents without invalidating the signature. A particularly concerning attack vector involves removing or altering characters within the SAML assertion's username field, effectively impersonating a legitimate user. The blast radius is significant, potentially impacting any application relying on @node-saml/node-saml for authentication, leading to unauthorized access and data breaches. This vulnerability shares similarities with other SAML manipulation attacks where improper handling of assertion data can lead to authentication bypass.

1. Reserviert2025-07-21
2. Veröffentlicht2025-07-28
3. Geändert2025-08-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-54419 is to upgrade to version 5.1.0 or later of the @node-saml/node-saml library. This version implements stricter validation and processing of SAML assertions, ensuring only verified content is utilized. If immediate upgrading is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement without deep packet inspection, proxy configurations can be adjusted to scrutinize SAML responses for unexpected modifications. Implement robust input validation on the application side to further reduce the risk of malicious data being accepted. After upgrading, confirm the fix by attempting to craft a malicious SAML assertion and verifying that it is rejected by the updated library.