PT-2025-31149 · Node-Saml · Node-Saml

Published 2025-07-28 · Updated 2025-09-03 · CVE-2025-54419

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Node-SAML versions 5.0.1 and below

Description Node-SAML improperly loads the assertion from the unsigned original response document, differing from the parts verified during signature checking. This allows modification of authentication details within a valid SAML assertion. An attacker could, for example, remove characters from the username within the SAML assertion. Exploitation requires a validly signed document from the identity provider (IdP).

Recommendations Update to version 5.1.0 or later.

Exploit

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

Related Identifiers

CVE-2025-54419

GHSA-4MXG-3P6V-XGQ3

Affected Products

Node-Saml

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54419.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-54419 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4mxg-3p6v-xgq3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54419 · Security Note
• https://github.com/node-saml/node-saml/commit/31ead9411ebc3e2385086fa9149b6c17732bca10 · Note
• https://github.com/node-saml/node-saml/releases/tag/v5.1.0 · Note
• https://github.com/node-saml/node-saml/security/advisories/GHSA-4mxg-3p6v-xgq3 · Note
• https://github.com/node-saml/node-saml · Note
• https://twitter.com/CVEnew/status/1949927614618935757 · Twitter Post
• https://t.me/cveNotify/130082 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1950041338495295810 · Twitter Post
• https://t.me/CVEtracker/28615 · Telegram Post
• https://twitter.com/CCBalert/status/1950197184709726716 · Twitter Post
• https://t.me/pentestingnews/65318 · Telegram Post
• https://twitter.com/Komodosec/status/1963302360585048252 · Twitter Post