---
id: CVE-2026-89042
title: >-
  passport-saml-encrypted through 0.1.13 Authentication Bypass via Missing
  Signature Verification
summary: >-
  passport-saml-encrypted through 0.1.13 makes SAML signature verification
  conditional on an optional cert option, allowing attackers to bypass
  authentication by submitting unsigned SAML responses. Attackers can post
  forged SAML responses …
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-347
vendor: krakenjs
product: passport-saml-encrypted
affected:
  - passport-saml-encrypted <= 0.1.13
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-11T17:09:27.774740Z'
published: '2026-09-10'
updated: '2026-09-11'
sourceUpdated: '2026-09-11T20:32:56.136Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89042'
references:
  - url: 'https://github.com/krakenjs/passport-saml-encrypted/issues/29'
    label: 'Reporter advisory: authentication bypass when cert is not configured'
  - url: >-
      https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L296
    label: Signature check gated on options.cert at v0.1.13
  - url: >-
      https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L321
    label: Same gate on the decrypted-assertion path at v0.1.13
  - url: 'https://github.com/krakenjs/passport-saml-encrypted'
    label: krakenjs/passport-saml-encrypted
  - url: >-
      https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-authentication-bypass-via-missing-signature-verification
    label: >-
      VulnCheck Advisory: passport-saml-encrypted through 0.1.13 Authentication
      Bypass via Missing Signature Verification
tags:
  - cve.org
epss: 0.00271
epssPercentile: 0.19628
ingestedAt: '2026-09-14T11:11:19.881Z'
---

## Overview

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

## Affected

- `passport-saml-encrypted <= 0.1.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.