Filtered by vendor Auth0 Subscriptions
Filtered by product Passport-wsfed-saml2 Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-23505 1 Auth0 1 Passport-wsfed-saml2 2023-07-14 7.5 High
Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.
CVE-2017-16897 1 Auth0 1 Passport-wsfed-saml2 2019-10-03 N/A
A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).