{"id":"CVE-2022-23505","aliases":["EUVD-2022-7706","GHSA-ppjq-qxhx-m25f"],"status":"published","title":"Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication","description":"Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.008,"percentile":0.57022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2022-12-13T07:04:23Z","modified":"2026-06-17T04:30:15Z","fixes":[{"ecosystem":"npm","package":"passport-wsfed-saml2","fixed_in":["4.6.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"passport-wsfed-saml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.3"}]}]},{"source":"osv","ecosystem":"npm","package":"passport-wsfed-saml2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.3"}]}]}],"products":[{"vendor":"auth0","product":"passport-wsfed-saml2"}],"references":[{"url":"https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-ppjq-qxhx-m25f","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23505","tags":["advisory"]},{"url":"https://github.com/auth0/passport-wsfed-saml2/pull/179","tags":["web"]},{"url":"https://github.com/advisories/GHSA-ppjq-qxhx-m25f"},{"url":"https://github.com/auth0/passport-wsfed-saml2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-23505","title":"Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authentication","description":"Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.","status":"published","published":"2022-12-13T07:04:23.487Z","modified":"2025-04-23T16:28:35.321Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:29.842547Z"}],"euvd":[{"id":"EUVD-2022-7706","description":"Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.","status":"published","published":"2022-12-13T07:04:23Z","modified":"2025-04-23T16:28:35Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:12.74685Z"}],"ghsa":[{"id":"GHSA-ppjq-qxhx-m25f","title":"Authentication Bypass for passport-wsfed-saml2","description":"# Overview\nA remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.\n\n# Am I affected?\nYou are affected if you are using WSFed protocol with the passport-wsfed-saml2 library versions \u003c 4.6.3. \nSAML2 protocol is not affected. \n\n# How do I fix it?\nUpgrade the library to version 4.6.3.\n\n# Will the fix impact my users?\nNo, the fix will not impact your users. ","status":"published","published":"2022-12-13T17:16:36Z","modified":"2023-01-31T05:07:11Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:36:29.957996Z"}],"nvd":[{"id":"CVE-2022-23505","description":"Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.","status":"published","published":"2022-12-13T08:15:09.067Z","modified":"2026-06-17T04:30:15.38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:07:33.649381Z"}],"osv":[{"id":"GHSA-ppjq-qxhx-m25f","title":"Authentication Bypass for passport-wsfed-saml2","description":"# Overview\nA remote attacker can bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed WSFed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered.\n\n# Am I affected?\nYou are affected if you are using WSFed protocol with the passport-wsfed-saml2 library versions \u003c 4.6.3. \nSAML2 protocol is not affected. \n\n# How do I fix it?\nUpgrade the library to version 4.6.3.\n\n# Will the fix impact my users?\nNo, the fix will not impact your users. ","status":"published","published":"2022-12-13T17:16:36Z","modified":"2023-11-08T04:08:19.819021Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:53.244788Z"}]}}