{"id":"GO-2026-6909","aliases":[],"status":"published","title":"Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml","description":"github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:\n\n1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional \u003csaml:Issuer\u003e element causes a nil-pointer dereference panic after signature verification.\n\n2. Subject uses the bare XML struct tag xml:\"NameID\", which matches \u003cNameID\u003e elements in any XML namespace. When a signed assertion omits \u003csaml:NameID\u003e and includes a \u003cNameID\u003e element in a foreign namespace inside \u003csaml:Subject\u003e, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-11-05T22:55:15Z","modified":"2026-11-05T23:15:16Z","affected":[{"source":"osv","ecosystem":"Go","package":"github.com/crewjam/saml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"references":[{"url":"https://github.com/golang/vulndb/issues/6909","tags":["report"]}],"sources":{"osv":[{"id":"GO-2026-6909","title":"Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml","description":"github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:\n\n1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional \u003csaml:Issuer\u003e element causes a nil-pointer dereference panic after signature verification.\n\n2. Subject uses the bare XML struct tag xml:\"NameID\", which matches \u003cNameID\u003e elements in any XML namespace. When a signed assertion omits \u003csaml:NameID\u003e and includes a \u003cNameID\u003e element in a foreign namespace inside \u003csaml:Subject\u003e, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.","status":"published","published":"2026-11-05T22:55:15Z","modified":"2026-11-05T23:15:16.667231831Z","updated_at":"2026-11-06T00:02:13.631839Z"}]}}