GHSA-5684-g483-2249
Signature Validation Bypass
Impact
Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.
This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.
Patches
A patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.
References
See the underlying advisory on goxmldsig for more details.
What each source reports
GitHub AdvisoriesNo score
Signature Validation Bypass
Impact
Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.
This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.
Patches
A patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.
References
See the underlying advisory on goxmldsig for more details.
- Record
GHSA-5684-g483-2249- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVNo score
Signature Validation Bypass
Impact
Given a valid SAML Response, an attacker can potentially modify the document, bypassing signature validation in order to pass off the altered document as a signed one.
This enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the identity provider, or full authentication bypass if an external attacker can obtain an expired, signed SAML Response.
Patches
A patch is available, users of gosaml2 should upgrade to v0.5.0 or higher.
References
See the underlying advisory on goxmldsig for more details.
- Record
GHSA-5684-g483-2249- Weakness
- CWE-347
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/russellhaering/gosaml2Go | before 0.5.0 | 0.5.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-5684-g483-2249 is a vulnerability with no CVSS score yet in github.com/russellhaering/gosaml2, published May 24, 2021. No source lists public exploit code. Fixed in github.com/russellhaering/gosaml2 0.5.0.