CVE-2025-47949 | samlify is a Node.js library for SAML single sign-on. A Sign… | CVSS 9.9 CRITICAL

Description

samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue.

Metadata

CVE ID: CVE-2025-47949
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-05-14 10:32 UTC
Published: 2025-05-19 19:28 UTC
Last updated: 2025-05-20 13:00 UTC
Primary CWE: CWE-347
CWE-347: Improper Verification of Cryptographic Signature
Vendor / Product: tngan / samlify
Sources: cve.org · NVD

Severity & Metrics

9.9 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
tngan	samlify	—	< 2.10.0

Weakness (CWE)

CWE	Source	Description
CWE-347	cna	CWE-347: Improper Verification of Cryptographic Signature

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

References (2)

https://github.com/tngan/samlify/security/advisories/GHSA-r683-v43c-6xqv https://github.com/tngan/samlify/security/advisories/GHSA-r683-v43c-6xqv
https://github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3 https://github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3