What is GHSA-mfcp-34xw-p57x?

GHSA-mfcp-34xw-p57x is a security advisory published by GitHub Security Advisories with Medium severity. Authentication Bypass in saml2-js

Why does GHSA-mfcp-34xw-p57x have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-mfcp-34xw-p57x?

GHSA-mfcp-34xw-p57x has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mfcp-34xw-p57x?

GHSA-mfcp-34xw-p57x affects 1 product, including: npm/saml2-js:\u003c 2.0.5.

GHSA-mfcp-34xw-p57xMediumCVSS 6.8Disclosed before NVD

Authentication Bypass in saml2-js

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Versions of saml2-js prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely.

Recommendation

Upgrade to version 2.0.5 or later.

🎯 Affected products1

npm/saml2-js:< 2.0.5

🔗 References (5)

https://github.com/Clever/saml2/pull/190
https://www.npmjs.com/advisories/1222
https://github.com/Clever/saml2/commit/ae0da4d0a0ea682a737be481e3bd78798be405c0
https://snyk.io/vuln/SNYK-JS-SAML2JS-474637
https://github.com/advisories/GHSA-mfcp-34xw-p57x