CVE-2026-89042 passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing Signature Verification
Attackers can bypass SAML authentication by submitting unsigned responses, gaining unauthorized access to user profiles.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89042?
CVE-2026-89042 is a critical authentication bypass vulnerability in krakenjs passport-saml-encrypted, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.
Weakness: CWE-347
Which versions are affected by CVE-2026-89042?
How do I fix CVE-2026-89042?
No fix has been published for CVE-2026-89042 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-89042 being exploited?
There is no known exploitation of CVE-2026-89042 in the wild and no public exploit code.
Sources
Also known as GHSA-vw3m-3x7w-24g8.