Back to Database
Status published
Critical
CVE-2025-47949
samlify SAML Signature Wrapping attack
Vulnerability Description
samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-47949
Credits & Attribution
No credits recorded in the NVD database.
Affected Vendor
tngan
View all reports →Affected Software
samlify
Vulnerable Versions:
< 2.10.0
Timeline
Official Publish:
May 19th, 2025
Last Modified:
May 20th, 2025
Added to House:
July 22nd, 2026