CVE-2025-47949: Samlify Auth Bypass Vulnerability

CVE-2025-47949 Overview

CVE-2025-47949 is a critical Signature Wrapping vulnerability discovered in samlify, a popular Node.js library used for implementing SAML (Security Assertion Markup Language) single sign-on authentication. This authentication bypass vulnerability allows attackers to forge SAML Responses and authenticate as any user within the target system. The vulnerability affects all versions of samlify prior to version 2.10.0.

SAML Signature Wrapping attacks exploit weaknesses in XML signature verification logic. An attacker who obtains a legitimately signed XML document from the identity provider can manipulate the SAML Response structure to inject malicious assertions while preserving the original signature. This allows the attacker to impersonate any user without possessing valid credentials.

Critical Impact

Attackers can forge SAML authentication responses to impersonate any user, completely bypassing authentication mechanisms and gaining unauthorized access to protected resources.

Affected Products

• samlify versions prior to 2.10.0
• Applications using samlify for SAML SSO authentication
• Node.js services implementing SAML-based identity federation

Discovery Timeline

• 2025-05-19 - CVE-2025-47949 published to NVD
• 2025-09-19 - Last updated in NVD database

Technical Details for CVE-2025-47949

Vulnerability Analysis

This vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature), which occurs when an application fails to properly verify the cryptographic signature of a message before acting on its contents. In the context of SAML authentication, this represents a fundamental security failure in the trust chain between identity providers and service providers.

The attack requires the adversary to possess a legitimately signed XML document from the target identity provider. This signed document serves as the foundation for the attack, as the attacker manipulates the XML structure to inject a forged assertion containing attacker-controlled identity claims while the original signature remains intact and valid.

The network-accessible nature of this vulnerability combined with the lack of required privileges or user interaction makes it particularly dangerous in enterprise environments where SAML SSO is commonly deployed for centralized authentication across multiple services.

Root Cause

The root cause of CVE-2025-47949 lies in improper verification of cryptographic signatures during SAML Response processing. The samlify library failed to adequately validate that the signed content matches the content being processed for authentication decisions. This disconnect between signature verification and assertion processing creates a window for XML Signature Wrapping attacks.

The vulnerability stems from the library not properly binding the signature to the exact assertion being evaluated, allowing attackers to insert unsigned malicious assertions while retaining a valid signature on a different portion of the document.

Attack Vector

The attack vector for CVE-2025-47949 involves network-based exploitation through the SAML authentication flow:

1. Prerequisite: Attacker obtains a legitimately signed SAML Response from the target identity provider (this could be from a previous valid authentication or intercepted traffic)
2. XML Manipulation: Attacker modifies the XML structure to inject a new, unsigned assertion containing the target user's identity
3. Signature Preservation: The original signature remains valid for the original signed content
4. Authentication Bypass: The vulnerable samlify library processes the injected assertion while incorrectly trusting the signature that applies to different content
5. Impersonation: Attacker gains access as the impersonated user

The fix implemented in version 2.10.0 included dependency updates to strengthen XML signature verification:

-"@xmldom/xmldom@^0.8.6":
-  version "0.8.6"
-  resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.6.tgz#8a1524eb5bd5e965c1e3735476f0262469f71440"
-  integrity sha512-uRjjusqpoqfmRkTaNuLJ2VohVr67Q5YwDATW3VU7PfzTj6IRaihGrYI7zckGZjxQPBIp63nfvJbM+Yu5ICh0Bg==
+"@xmldom/is-dom-node@^1.0.1":
+  version "1.0.1"
+  resolved "https://registry.yarnpkg.com/@xmldom/is-dom-node/-/is-dom-node-1.0.1.tgz#83b9f3e1260fb008061c6fa787b93a00f9be0629"
+  integrity sha512-CJDxIgE5I0FH+ttq/Fxy6nRpxP70+e2O048EPe85J2use3XKdatVM7dDVvFNjQudd9B49NPoZ+8PG49zj4Er8Q==

+"@xmldom/xmldom@^0.8.10":
+  version "0.8.10"
+  resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.10.tgz#a1337ca426aa61cef9fe15b5b28e340a72f6fa99"
+  integrity sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw==

Source: GitHub Commit Update

Detection Methods for CVE-2025-47949

Indicators of Compromise

• Unusual authentication events where users successfully authenticate from unexpected locations or devices
• SAML assertions with mismatched timestamps or anomalous XML structures in authentication logs
• Multiple successful authentications for different users originating from the same source IP in rapid succession
• Authentication audit logs showing access to high-privilege accounts without corresponding identity provider login events

Detection Strategies

• Implement SAML Response logging and review for XML structural anomalies that may indicate wrapping attacks
• Monitor for authentication patterns where users access resources without corresponding identity provider authentication events
• Deploy application-level detection rules to identify SAML Responses with multiple assertions or unusual XML structures
• Use SentinelOne Singularity XDR to correlate authentication events across identity providers and service providers for anomaly detection

Monitoring Recommendations

• Enable comprehensive logging of all SAML authentication transactions including full assertion details
• Implement alerting on successful authentications to sensitive systems from unusual network locations
• Conduct regular audits of privileged account access patterns to identify potential impersonation attempts
• Monitor dependency versions across Node.js applications to ensure samlify is updated to 2.10.0 or later

How to Mitigate CVE-2025-47949

Immediate Actions Required

• Upgrade samlify to version 2.10.0 or later immediately to remediate this vulnerability
• Audit authentication logs for any suspicious SAML authentication events that may indicate prior exploitation
• Review all service provider applications using samlify and prioritize patching based on sensitivity of protected resources
• Consider temporarily disabling SAML SSO for critical systems until the patch is deployed if immediate upgrade is not possible

Patch Information

The vulnerability is fixed in samlify version 2.10.0. The security patch includes updates to XML processing dependencies, specifically upgrading @xmldom/xmldom to version 0.8.10 and adding the @xmldom/is-dom-node dependency to improve signature verification integrity.

Organizations should update their package.json or yarn.lock files and redeploy affected applications. The fix is available through the GitHub Commit Update. Additional details are provided in the GitHub Security Advisory.

Workarounds

• Implement additional authentication factors beyond SAML SSO for access to highly sensitive resources
• Deploy Web Application Firewall (WAF) rules to inspect and validate SAML Response structures before they reach applications
• Restrict network access to SAML endpoints to only authorized identity provider IP ranges where feasible
• Enable strict assertion validation at the application layer as a defense-in-depth measure

# Update samlify to patched version
npm update samlify@2.10.0

# Or using yarn
yarn upgrade samlify@2.10.0

# Verify the installed version
npm list samlify