CVE-2017-1000452
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
- Record
CVE-2017-1000452- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-91
- Updated
- 2026-11-02
CVE List No score
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
- Record
CVE-2017-1000452- Updated
- 2026-11-02
EUVDEUVD-2018-0156 No score
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
- Record
EUVD-2018-0156- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8jjf-w7j6-323c
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.
Recommendation
Upgrade to version 2.4.0-rc5 or later
- Record
GHSA-8jjf-w7j6-323c- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-91, CWE-347
- Updated
- 2026-11-02
OSV
An XML Signature Wrapping vulnerability exists in Samlify 2.2.0 and earlier, and in predecessor Express-saml2 which could allow attackers to impersonate arbitrary users.
- Record
CVE-2017-1000452- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-8jjf-w7j6-323c
Samlify vulnerable to Authentication Bypass by allowing tokens to be reused with different usernames
Versions of samlify prior to 2.4.0-rc5 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.
Recommendation
Upgrade to version 2.4.0-rc5 or later
- Record
GHSA-8jjf-w7j6-323c- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-347, CWE-91
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
samlifynpm |
before 2.4.0-rc5 | 2.4.0-rc5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-1000452 is a high vulnerability (CVSS 7.5) in Samlify Project Samlify, published January 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in samlify 2.4.0-rc5.
References
github.com/tngan/samlify/releases/tag/v2.3.0
whitehats.nl/blog/xml-signature-wrapping-samlify
nvd.nist.gov/vuln/detail/CVE-2017-1000452
hackerone.com/reports/356284