GHSA-433w-mm6h-rv9p
Auth bypass in SAML provider
GHSA-433w-mm6h-rv9p is a vulnerability with no CVSS score yet in github.com/netlify/gotrue, published June 23, 2021. No source lists public exploit code. Fixed in github.com/netlify/gotrue 1.0.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.0.0github.com/netlify/gotrue
Description
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:
Patches
Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90
Workarounds
No known workarounds.
For more information
If you have any questions or comments about this advisory:
- Open an issue in gotrue
- Email us at security@netlify.com
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/netlify/gotrueGo | before 1.0.0 | 1.0.0 |
What each source reports
GitHub AdvisoriesNo score
Auth bypass in SAML provider
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:
Patches
Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90
Workarounds
No known workarounds.
For more information
If you have any questions or comments about this advisory:
- Open an issue in gotrue
- Email us at security@netlify.com
- Record
GHSA-433w-mm6h-rv9p- Updated
- 2026-11-02
OSVNo score
Auth bypass in SAML provider
Impact
The following vulnerabilities have been disclosed, which impact users leveraging the SAML auth provider:
Patches
Please upgrade to v1.0.0 or commit hash a2b4dd6bc4ef7562d1df044098b303f564eefa90
Workarounds
No known workarounds.
For more information
If you have any questions or comments about this advisory:
- Open an issue in gotrue
- Email us at security@netlify.com
- Record
GHSA-433w-mm6h-rv9p- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.