CRITICAL

GHSA-r683-v43c-6xqv

samlify SAML Signature Wrapping attack

Quick fix

GHSA-r683-v43c-6xqv — samlify: upgrade to the fixed version with the command below.

npm install samlify@2.10.0

Details

A Signature Wrapping attack has been found in samlify <v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/samlify

Introduced in: 0Fixed in: 2.10.0

Fixnpm install samlify@2.10.0

References

https://github.com/tngan/samlify/security/advisories/GHSA-r683-v43c-6xqv[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2025-47949[ADVISORY]
https://github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3[WEB]
https://github.com/tngan/samlify[PACKAGE]