CVE-2025-54369: Node-SAML Auth Bypass Vulnerability

CVE-2025-54369 Overview

CVE-2025-54369 is a critical authentication bypass vulnerability in Node-SAML, a SAML library that runs in Node.js environments without framework dependencies. The vulnerability allows attackers to modify authentication details within a valid SAML assertion due to improper signature verification handling. In affected versions (5.0.1 and below), Node-SAML loads the assertion from the unsigned original response document rather than the parts that are actually verified when checking signatures. This discrepancy enables attackers to manipulate critical authentication data, such as removing characters from usernames, while maintaining a valid signature.

Critical Impact

Attackers can bypass authentication controls by manipulating SAML assertions to modify user identity information, potentially gaining unauthorized access to protected resources or impersonating other users.

Affected Products

• Node-SAML versions 5.0.1 and below
• Applications using Node-SAML for SAML authentication
• Node.js applications implementing SAML-based Single Sign-On (SSO)

Discovery Timeline

• 2025-07-24 - CVE-2025-54369 published to NVD
• 2025-12-15 - Last updated in NVD database

Technical Details for CVE-2025-54369

Vulnerability Analysis

This vulnerability is classified under CWE-87 (Improper Neutralization of Alternate XSS Syntax). The core issue stems from a fundamental flaw in how Node-SAML processes SAML responses. When a SAML response is received, the library performs signature verification on specific elements of the XML document. However, when extracting authentication assertions for processing, the library references the original unsigned document rather than the verified, signed portions.

This architectural flaw creates a window where an attacker can craft a malicious SAML response that passes signature validation while containing modified authentication data in the portions that are actually consumed by the application. The attack is particularly dangerous because the signature verification technically succeeds, giving administrators and security tools a false sense of security.

Root Cause

The root cause lies in the mismatch between the XML elements used for signature verification and those used for assertion extraction. Node-SAML maintains references to both the original response document and the signed assertion elements. During processing, the library incorrectly loads assertion data from the unsigned original document instead of ensuring that only cryptographically verified data is used for authentication decisions.

This is a classic XML Signature Wrapping (XSW) variant vulnerability where the library fails to properly bind the signature verification to the data extraction process, allowing manipulation of the unsigned document portions without invalidating the signature.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with access to a valid SAML response can modify the unsigned portions of the XML document while preserving the valid signature. For example, an attacker could intercept a legitimate SAML assertion and modify the username field in the unsigned portion—such as removing characters to match a different user account—while the signature verification continues to pass on the original signed elements.

The vulnerability allows for various manipulation scenarios including username modification (character removal or substitution), role/attribute tampering, and session identifier manipulation, all while maintaining cryptographic validity of the SAML response signature.

Detection Methods for CVE-2025-54369

Indicators of Compromise

• Unexpected authentication events where usernames appear truncated or modified
• SAML assertion logs showing discrepancies between signed and processed identity data
• Authentication anomalies where users appear to access accounts they shouldn't have permission to reach
• Unusual patterns in SSO login attempts, particularly failed attempts followed by successful ones with similar but slightly different usernames

Detection Strategies

• Implement SAML response logging that captures both raw responses and processed assertion data for comparison analysis
• Deploy web application firewall (WAF) rules to detect malformed or unusually structured SAML responses
• Enable detailed authentication logging to track any discrepancies between IdP-issued assertions and application-processed identities
• Monitor for XML signature wrapping attack patterns in incoming SAML traffic

Monitoring Recommendations

• Configure alerting for authentication events with usernames that closely match but don't exactly match known user accounts
• Implement integrity monitoring on Node-SAML library files to detect unauthorized modifications
• Set up baseline monitoring for SAML response structures to identify anomalous patterns
• Review authentication logs regularly for signs of identity manipulation attempts

How to Mitigate CVE-2025-54369

Immediate Actions Required

• Upgrade Node-SAML to version 5.1.0 or later immediately
• Audit authentication logs for signs of exploitation prior to patching
• Review all accounts that authenticated via SAML during the vulnerable period for unauthorized access
• Implement additional authentication controls such as MFA as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in Node-SAML version 5.1.0. The fix ensures that assertion data is loaded only from the verified, signed portions of the SAML response, eliminating the discrepancy between signature verification and data extraction. The patch is available via the GitHub Release v5.1.0. Technical details about the fix can be found in the GitHub commit. Additional security information is available in the GitHub Security Advisory GHSA-m837-g268-mmv7.

Workarounds

• If immediate upgrade is not possible, implement additional server-side validation of SAML assertion usernames against known user databases
• Temporarily disable SAML-based authentication and switch to alternative authentication mechanisms until patching is complete
• Deploy network-level controls to restrict SAML traffic sources to trusted Identity Providers only
• Implement request signing validation at the application layer as an additional verification step

# Upgrade Node-SAML to patched version
npm update node-saml@5.1.0

# Verify installed version
npm list node-saml