Critical SAMLify SSO Vulnerability Enables Admin Impersonation via Signature Wrapping

A critical authentication bypass vulnerability (CVE-2025-47949) in the Node.js SAML library samlify allows attackers to forge admin-level access by injecting unsigned assertions into signed SAML responses. The flaw, rated high severity due to its low exploitation complexity, affects versions prior to v2.10.0 and has been patched in a recent update¹.

Technical Breakdown of the Vulnerability

The vulnerability stems from improper validation of XML signatures in SAML responses. Attackers can craft malicious assertions while retaining the original valid signature, exploiting a signature wrapping weakness. The library’s default behavior of selecting the first Assertion tag without verifying its signature enables this bypass².

Proof of Concept (PoC) demonstrates the attack vector:

<samlp:Response>
  <saml:Assertion ID="attacker">  <!-- Unsigned -->
    <saml:NameID>[email protected]</saml:NameID>
  </saml:Assertion>
  <ds:Signature>...</ds:Signature>  <!-- Valid but references a different ID -->
</samlp:Response>

The vulnerable code in samlify prior to v2.10.0 used:

// Vulnerable: Uses first Assertion, not the signed one
const assertion = doc.getElementsByTagName("Assertion")[0];

Mitigation and Patch Guidance

Organizations using samlify should immediately upgrade to version 2.10.0 or later. The patched version enforces strict reference validation by explicitly checking the signed element’s ID:

const signedElement = sig.references[0].uri.replace('#', '');
const signedAssertion = doc.querySelector(`[ID="${signedElement}"]`);

Additional security measures recommended by researchers include:

Enforcing HTTPS for all SAML transactions
Implementing multi-factor authentication (MFA) to reduce credential theft risks
Monitoring Identity Provider (IdP) metadata changes

Broader SSO Security Implications

This vulnerability highlights systemic risks in SAML implementations. Similar flaws have been found in other libraries like ruby-saml (CVE-2025-25291/25292) and GitHub Enterprise (CVE-2024-4985)³. The Belgian Centre for Cybersecurity (CCB) has issued an advisory warning about the potential for widespread exploitation⁴.

Enterprise security teams should conduct thorough audits of all SAML implementations, particularly focusing on:

XML signature validation processes
Parser consistency across different XML processing libraries
Canonicalization methods (xml-exc-c14n#)

Conclusion

The samlify vulnerability demonstrates how subtle implementation flaws in SSO systems can lead to complete authentication bypass. While the patch is available, organizations must remain vigilant against similar weaknesses in other SAML libraries. Regular security audits, prompt patching, and defense-in-depth strategies including MFA remain critical for maintaining secure authentication systems.