CVE-2025-54369: Node-SAML Auth Bypass Vulnerability

CVE-2025-54369 Overview

CVE-2025-54369 is a critical authentication bypass vulnerability in Node-SAML, a SAML library that runs in Node.js environments without framework dependencies. The vulnerability allows attackers to modify authentication details within a valid SAML assertion due to improper signature verification handling. In affected versions (5.0.1 and below), Node-SAML loads the assertion from the unsigned original response document rather than the parts that are actually verified when checking signatures. This discrepancy enables attackers to manipulate critical authentication data, such as removing characters from usernames, while maintaining a valid signature.

Critical Impact
Attackers can bypass authentication controls by manipulating SAML assertions to modify user identity information, potentially gaining unauthorized access to protected resources or impersonating other users.

Affected Products

Node-SAML versions 5.0.1 and below
Applications using Node-SAML for SAML authentication
Node.js applications implementing SAML-based Single Sign-On (SSO)

Discovery Timeline

2025-07-24 - CVE-2025-54369 published to NVD
2025-12-15 - Last updated in NVD database

Technical Details for CVE-2025-54369

Vulnerability Analysis

This vulnerability is classified under CWE-87 (Improper Neutralization of Alternate XSS Syntax). The core issue stems from a fundamental flaw in how Node-SAML processes SAML responses. When a SAML response is received, the library performs signature verification on specific elements of the XML document. However, when extracting authentication assertions for processing, the library references the original unsigned document rather than the verified, signed portions.

This architectural flaw creates a window where an attacker can craft a malicious SAML response that passes signature validation while containing modified authentication data in the portions that are actually consumed by the application. The attack is particularly dangerous because the signature verification technically succeeds, giving administrators and security tools a false sense of security.

Root Cause

The root cause lies in the mismatch between the XML elements used for signature verification and those used for assertion extraction. Node-SAML maintains references to both the original response document and the signed assertion elements. During processing, the library incorrectly loads assertion data from the unsigned original document instead of ensuring that only cryptographically verified data is used for authentication decisions.

This is a classic XML Signature Wrapping (XSW) variant vulnerability where the library fails to properly bind the signature verification to the data extraction process, allowing manipulation of the unsigned document portions without invalidating the signature.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with access to a valid SAML response can modify the unsigned portions of the XML document while preserving the valid signature. For example, an attacker could intercept a legitimate SAML assertion and modify the username field in the unsigned portion—such as removing characters to match a different user account—while the signature verification continues to pass on the original signed elements.

The vulnerability allows for various manipulation scenarios including username modification (character removal or substitution), role/attribute tampering, and session identifier manipulation, all while maintaining cryptographic validity of the SAML response signature.

Detection Methods for CVE-2025-54369

Indicators of Compromise

Unexpected authentication events where usernames appear truncated or modified
SAML assertion logs showing discrepancies between signed and processed identity data
Authentication anomalies where users appear to access accounts they shouldn't have permission to reach
Unusual patterns in SSO login attempts, particularly failed attempts followed by successful ones with similar but slightly different usernames

Detection Strategies

Implement SAML response logging that captures both raw responses and processed assertion data for comparison analysis
Deploy web application firewall (WAF) rules to detect malformed or unusually structured SAML responses
Enable detailed authentication logging to track any discrepancies between IdP-issued assertions and application-processed identities
Monitor for XML signature wrapping attack patterns in incoming SAML traffic

Monitoring Recommendations

Configure alerting for authentication events with usernames that closely match but don't exactly match known user accounts
Implement integrity monitoring on Node-SAML library files to detect unauthorized modifications
Set up baseline monitoring for SAML response structures to identify anomalous patterns
Review authentication logs regularly for signs of identity manipulation attempts

How to Mitigate CVE-2025-54369

Immediate Actions Required

Upgrade Node-SAML to version 5.1.0 or later immediately
Audit authentication logs for signs of exploitation prior to patching
Review all accounts that authenticated via SAML during the vulnerable period for unauthorized access
Implement additional authentication controls such as MFA as a defense-in-depth measure

Patch Information

The vulnerability has been addressed in Node-SAML version 5.1.0. The fix ensures that assertion data is loaded only from the verified, signed portions of the SAML response, eliminating the discrepancy between signature verification and data extraction. The patch is available via the GitHub Release v5.1.0. Technical details about the fix can be found in the GitHub commit. Additional security information is available in the GitHub Security Advisory GHSA-m837-g268-mmv7.

Workarounds

If immediate upgrade is not possible, implement additional server-side validation of SAML assertion usernames against known user databases
Temporarily disable SAML-based authentication and switch to alternative authentication mechanisms until patching is complete
Deploy network-level controls to restrict SAML traffic sources to trusted Identity Providers only
Implement request signing validation at the application layer as an additional verification step

bash

# Upgrade Node-SAML to patched version
npm update node-saml@5.1.0

# Verify installed version
npm list node-saml