CVE-2025-24894: Critical SAML Authentication Flaw in SPID.AspNetCore.Authentication

The core of the vulnerability lies in the library's handling of SAML assertions, the data exchanged between the Identity Provider (IdP) and the Service Provider (SP) during authentication. An attacker can craft malicious SAML assertions, manipulating the identity information presented to the Service Provider. This manipulation could allow them to impersonate legitimate users, gain access to sensitive data, or escalate privileges within the system. The potential impact is significant, as successful exploitation could compromise the entire application relying on SPID.AspNetCore.Authentication for authentication. The SPID library acts as the Service Provider (SP) in the SAML2 flow, making it a critical point of attack.

1. Reserved2025-01-27
2. Published2025-02-18
3. EPSS updated2026-04-02

The primary mitigation for CVE-2025-24894 is to immediately upgrade to version 3.4.0 of SPID.AspNetCore.Authentication. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing stricter validation of incoming SAML assertions at the Service Provider level. This might involve verifying the signature of the assertion, checking the issuer, and validating the attributes contained within the assertion. Web Application Firewalls (WAFs) configured to inspect SAML traffic can also provide a layer of defense by detecting and blocking malicious assertions. After upgrading, confirm the fix by attempting to authenticate with a test user and verifying that the application behaves as expected.