CVE-2025-47949
samlify SAML Signature Wrapping attack
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
samlify SAML Signature Wrapping attack
samlify is a Node.js library for SAML single sign-on. A Signature Wrapping attack has been found in samlify prior to version 2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider. Version 2.10.0 fixes the issue.
Reserved 2025-05-14 | Published 2025-05-19 | Updated 2025-05-20 | Assigner GitHub_MCWE-347: Improper Verification of Cryptographic Signature
github.com/...amlify/security/advisories/GHSA-r683-v43c-6xqv
github.com/...ommit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3
Support options
