CVE-2025-54369 - CVE House

Back to Database

Status published Critical CVE-2025-54369

Node-SAML SAML Authentication Bypass

9.3 CVSS

Vulnerability Description

Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify authentication details within a valid SAML assertion. For example, in one attack it is possible to remove any character from the SAML assertion username. This issue is fixed in version 5.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54369

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from node-saml

View All →

Node-SAML Contains SAML Signature Verification Vulnerability

xml-crypto Vulnerable to XML Signature Verification Bypass via DigestValue Comment

xml-crypto Vulnerable to XML Signature Verification Bypass via Multiple SignedInfo References

XML signature verification bypass due improper verification of signature / signature spoofing

@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError

Affected Vendor

node-saml

View all reports →

Affected Software

node-saml

Vulnerable Versions:

< 5.1.0

Timeline

Official Publish: December 12th, 2025

Last Modified: May 7th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls

Defense Evasion

T1190 Exploit Public-Facing Application

T1078 Valid Accounts

T1550 Use Alternate Authentication Material

Defense Evasion

T1565 Data Manipulation