PT-2026-42665 · Root+4 · @Rootio/Samlify+1
CVE-2026-46490
·
Published
2026-05-21
·
Updated
2026-07-23
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
samlify versions prior to 2.13.0
Description
samlify is a Node.js library for SAML single sign-on. The template substitution mechanism only escapes attribute contexts, meaning values inserted into element text, such as
<saml:AttributeValue>, are not escaped. This occurs because the replaceTagsByValue() function in src/libsaml.ts only escapes placeholders when they are preceded by a quote. Consequently, a user can inject XML markup into an attribute value (e.g., email or name) to add new <saml:Attribute> elements inside a signed assertion. The Identity Provider (IdP) then signs the tampered assertion, and the Service Provider (SP) accepts the injected attributes as trusted. This can lead to privilege escalation if attributes are used for authorization, such as roles or groups.Recommendations
Update to version 2.13.0.
Exploit
Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Rootio/Samlify
Samlify