GHSA-rrfw-hg9m-j47h
Signature Validation Bypass
GHSA-rrfw-hg9m-j47h is a vulnerability with no CVSS score yet in github.com/russellhaering/goxmldsig, published May 24, 2021. No source lists public exploit code. Fixed in github.com/russellhaering/goxmldsig 0.4.2.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.2github.com/russellhaering/goxmldsig +1 more
Description
Impact
An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.
Patches
Version 0.4.2 bumps the dependency which should fix the issue.
For more information
Please see the advisory in goxmldsig
Credits
The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/russellhaering/goxmldsigGo | through 0.4.1 | 0.4.2 |
github.com/russellhaering/goxmldsigGo | before 0.4.2 | 0.4.2 |
What each source reports
GitHub AdvisoriesNo score
Signature Validation Bypass
Impact
An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.
Patches
Version 0.4.2 bumps the dependency which should fix the issue.
For more information
Please see the advisory in goxmldsig
Credits
The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
- Record
GHSA-rrfw-hg9m-j47h- Weakness
- CWE-347
- Updated
- 2026-11-02
OSVNo score
Signature Validation Bypass
Impact
An authentication bypass exists in the goxmldsig this library uses to determine if SAML assertions are genuine. An attacker could craft a SAML response that would appear to be valid but would not have been genuinely issued by the IDP.
Patches
Version 0.4.2 bumps the dependency which should fix the issue.
For more information
Please see the advisory in goxmldsig
Credits
The original vulnerability was discovered by @jupenur. Thanks to @russellhaering for the heads up.
- Record
GHSA-rrfw-hg9m-j47h- Weakness
- CWE-347
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.