CVE-2025-47949 samlify SAML Signature Wrapping attack
Attackers can forge SAML responses to authenticate as any user in samlify, requiring a signed XML document from the identity provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47949?
CVE-2025-47949 is a critical authentication bypass vulnerability in tngan samlify, published on 19 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue.
Weakness: CWE-347
Which versions are affected by CVE-2025-47949?
2 open source packages ship an affected version, including samlify. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
samlify npm | All versions | 2.10.0 |
samlify npm | All versions | 2.10.0 |
Products include Samlify Project Samlify.
How do I fix CVE-2025-47949?
Upgrade samlify to 2.10.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-47949 being exploited?
There is no known exploitation of CVE-2025-47949 in the wild and no public exploit code.
Other vulnerabilities in tngan samlify
Sources
Also known as GHSA-r683-v43c-6xqv, ROOT-APP-NPM-CVE-2025-47949.