CVE-2025-54419: Node-SAML Auth Bypass Vulnerability

CVE-2025-54419 Overview

CVE-2025-54419 is a critical authentication bypass vulnerability in Node-SAML, a framework-agnostic SAML library for Node.js applications. The vulnerability exists in version 5.0.1, where the library incorrectly loads assertion data from the unsigned original response document rather than from the signed and verified portions of the SAML response. This discrepancy between what is verified and what is used allows attackers to modify authentication details within an otherwise valid SAML assertion.

Critical Impact

This vulnerability enables attackers with access to a validly signed SAML document from an Identity Provider (IdP) to manipulate authentication details, including the ability to modify usernames character-by-character. This could lead to complete authentication bypass and unauthorized access to protected resources.

Affected Products

• Node-SAML version 5.0.1
• Applications using Node-SAML 5.0.1 for SAML-based authentication
• Node.js services implementing SAML SSO with the affected library version

Discovery Timeline

• 2025-07-28 - CVE-2025-54419 published to NVD
• 2025-07-29 - Last updated in NVD database

Technical Details for CVE-2025-54419

Vulnerability Analysis

This vulnerability is classified under CWE-287 (Improper Authentication), representing a fundamental flaw in how Node-SAML processes SAML assertions. The core issue stems from a mismatch between the XML elements that undergo cryptographic signature verification and the XML elements that are subsequently used for authentication decisions.

In SAML authentication flows, Identity Providers digitally sign assertions to ensure integrity and authenticity. The signature verification process is designed to detect any tampering with the signed content. However, Node-SAML version 5.0.1 contains a critical flaw where the library performs signature verification on one portion of the XML document but extracts authentication attributes from a different, unsigned portion of the original response.

This architectural flaw means an attacker can craft a malicious SAML response that passes signature validation while containing manipulated authentication data. The attack is particularly dangerous because it does not require breaking any cryptographic protections—instead, it exploits the logical separation between verification and data extraction.

Root Cause

The root cause is an improper data source selection during SAML assertion processing. Node-SAML version 5.0.1 validates signatures against specific XML elements but then retrieves user identity information from the original, unverified response document. This creates a vulnerability window where unsigned data influences security decisions.

The library fails to maintain the security principle that only cryptographically verified data should be trusted for authentication purposes. By loading assertion values from the unsigned original document instead of the verified signed content, the library undermines the entire purpose of SAML's digital signature mechanism.

Attack Vector

The attack requires an attacker to possess a validly signed SAML document from the target Identity Provider. With this document, the attacker can manipulate authentication attributes such as usernames within the unsigned portions of the response while preserving the valid signature on other elements.

One documented attack scenario involves character removal from usernames. An attacker could modify the SAML assertion to remove specific characters from a username, potentially impersonating other users in the system. For example, removing characters could transform one user's identity into another's, enabling unauthorized access to accounts and resources.

The attack is network-accessible and requires no user interaction or special privileges, making it highly exploitable in environments where SAML-based single sign-on is deployed. The attacker only needs to intercept or obtain a single valid SAML response to craft malicious authentication requests.

Detection Methods for CVE-2025-54419

Indicators of Compromise

• SAML assertions containing discrepancies between signed and unsigned XML element values
• Authentication logs showing unexpected username variations or character substitutions
• Multiple authentication attempts with similar but slightly different user identifiers
• Unusual patterns in SAML response processing where usernames differ from expected IdP values

Detection Strategies

• Implement logging that captures both the signed assertion content and the extracted authentication attributes for comparison
• Monitor for authentication events where the authenticated username differs from known user directory entries
• Deploy application-level monitoring to detect SAML processing anomalies
• Review authentication logs for patterns of character-level username manipulation

Monitoring Recommendations

• Enable verbose logging on SAML authentication endpoints to capture full assertion details
• Implement real-time alerting for authentication events involving unknown or modified usernames
• Cross-reference authenticated identities against authoritative user directories
• Monitor Node-SAML library usage across your environment to identify vulnerable deployments

How to Mitigate CVE-2025-54419

Immediate Actions Required

• Upgrade Node-SAML to version 5.1.0 or later immediately
• Audit all applications in your environment using Node-SAML for SAML authentication
• Review recent authentication logs for signs of exploitation or unusual access patterns
• Notify security teams of systems using SAML-based authentication that may be affected

Patch Information

The vulnerability is fixed in Node-SAML version 5.1.0. The fix ensures that assertion data is loaded from the verified signed content rather than the unsigned original response document. Organizations should update their dependencies to include at least version 5.1.0 of the library.

For detailed information about the fix, refer to the GitHub Security Advisory GHSA-4mxg-3p6v-xgq3 and the release notes for version 5.1.0. The specific code changes can be reviewed in the commit 31ead94.

Workarounds

• If immediate patching is not possible, consider temporarily disabling SAML-based authentication in favor of alternative authentication methods
• Implement additional server-side validation of authenticated user identities against authoritative sources
• Deploy web application firewall rules to inspect and validate SAML responses before processing
• Restrict network access to SAML endpoints to trusted Identity Provider IP ranges

# Update Node-SAML to patched version
npm update node-saml@5.1.0

# Verify installed version
npm list node-saml

# For yarn users
yarn upgrade node-saml@5.1.0