SEPTEMBER 15, 2026
Live Feed
Back to database
Case File

CVE-2026-89043

HIGH · CVSS 7.4 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-10 · Last synced 2026-09-15

CyberRota Analysis

AI-Generated

The vulnerability affects the passport-saml-encrypted library versions up to 0.1.13, where an XML signature wrapping flaw allows attackers to prepend a forged unsigned assertion to a validly signed SAML message. This can lead to unauthorized access, as the system may accept the forged assertion as a verified identity due to inadequate cross-validation during signature verification. Organizations utilizing this library for SAML authentication should prioritize patching to mitigate the risk of identity spoofing.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-89043
Severity
HIGH
CVSS
7.4
EPSS
0.28%

Original NVD Description

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.