---
id: CVE-2026-89043
title: >-
  passport-saml-encrypted through 0.1.13 XML Signature Wrapping via Assertion
  Prepending
summary: >-
  passport-saml-encrypted through 0.1.13 contains an XML signature wrapping
  vulnerability where signature verification and assertion extraction use
  independent XPath lookups with no cross-validation. Attackers holding any
  validly signed SA…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-347
vendor: krakenjs
product: passport-saml-encrypted
affected:
  - passport-saml-encrypted <= 0.1.13
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-10T17:53:33.236465Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T17:53:56.984Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89043'
references:
  - url: 'https://github.com/krakenjs/passport-saml-encrypted/issues/30'
    label: 'Reporter advisory: XML signature wrapping'
  - url: >-
      https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L256
    label: Signature located by an unconstrained XPath at v0.1.13
  - url: >-
      https://github.com/krakenjs/passport-saml-encrypted/blob/v0.1.13/lib/saml.js#L328
    label: Assertion selected by a separate first-match XPath at v0.1.13
  - url: 'https://github.com/krakenjs/passport-saml-encrypted'
    label: krakenjs/passport-saml-encrypted
  - url: >-
      https://www.vulncheck.com/advisories/passport-saml-encrypted-through-0.1.13-xml-signature-wrapping-via-assertion-prepending
    label: >-
      VulnCheck Advisory: passport-saml-encrypted through 0.1.13 XML Signature
      Wrapping via Assertion Prepending
tags:
  - cve.org
  - exploit-available
epss: 0.00284
epssPercentile: 0.21226
ingestedAt: '2026-09-11T14:42:19.864Z'
---

## Overview

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.

## Affected

- `passport-saml-encrypted <= 0.1.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.