CVE-2022-39299
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of node-saml before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of node-saml before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
- Record
CVE-2022-39299- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2022-7124
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of node-saml before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
- Record
EUVD-2022-7124- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m974-647v-whv7
Signature bypass via multiple root elements
Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
Patches
Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5.
Workarounds
Disable SAML authentication.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Open a discussion in the node-saml repo
Credits
- Felix Wilhelm of Google Project Zero
- Record
GHSA-m974-647v-whv7- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of node-saml before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
- Record
CVE-2022-39299- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
Signature bypass via multiple root elements in Passport-SAML
Passport-SAML is a SAML 2.0 authentication provider for Passport, the Node.js authentication library. A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. Users should upgrade to passport-saml version 3.2.2 or newer. The issue was also present in the beta releases of node-saml before version 4.0.0-beta.5. If you cannot upgrade, disabling SAML authentication may be done as a workaround.
- Record
CVE-2022-39299- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVGHSA-m974-647v-whv7
Signature bypass via multiple root elements
Impact
A remote attacker may be able to bypass SAML authentication on a website using passport-saml. A successful attack requires that the attacker is in possession of an arbitrary IDP signed XML element. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.
Patches
Users should upgrade to passport-saml 3.2.2 or newer. The issue was also present in the beta releases of node-saml before v4.0.0-beta.5.
Workarounds
Disable SAML authentication.
References
Are there any links users can visit to find out more?
For more information
If you have any questions or comments about this advisory:
- Open a discussion in the node-saml repo
Credits
- Felix Wilhelm of Google Project Zero
- Record
GHSA-m974-647v-whv7- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
passport-samlnpm |
before 3.2.2 | 3.2.2 |
node-samlnpm |
before 4.0.0-beta.5 | 4.0.0-beta.5 |
@node-saml/node-samlnpm |
before 4.0.0-beta.5 | 4.0.0-beta.5 |
@node-saml/passport-samlnpm |
before 4.0.0-beta.3 | 4.0.0-beta.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | doyensec/CVE-2022-39299_PoC_Generator | 2022-10-31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-39299 is a high vulnerability (CVSS 7.4) in Node-saml Passport-saml, published October 12, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.49%, the 91st percentile. Fixed in passport-saml 3.2.2.
References
github.com/node-saml/passport-saml/security/advisories/GHSA-m974-647v-whv7
packetstormsecurity.com/files/169826/Node-saml-Root-Element-Signature-Bypass.html
nvd.nist.gov/vuln/detail/CVE-2022-39299