CVE-2026-46490

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-46490
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups). This issue has been patched in version 2.13.0.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m Exploit Vendor Advisory
https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:samlify_project:samlify:*:*:*:*:*:*:*:*
History

23 Jul 2026, 08:10

Type Values Removed Values Added
Summary
  • (es) samlify es una biblioteca Node.js para inicio de sesión único SAML. Anterior a la versión 2.13.0, la sustitución de plantillas de samlify solo escapa contextos de atributos. Los valores insertados en el texto del elemento (p. ej., <saml:AttributeValue>) no se escapan. Un usuario normal puede inyectar marcado XML en un valor de atributo (p. ej., correo electrónico, nombre) y añadir nuevos elementos <saml:Attribute> dentro de la aserción firmada. El IdP luego firma la aserción manipulada y el SP acepta los atributos inyectados como confiables. Esto permite la escalada de privilegios cuando los atributos se utilizan para la autorización (roles/grupos). Este problema ha sido parcheado en la versión 2.13.0.

09 Jun 2026, 16:48

Type Values Removed Values Added
CPE cpe:2.3:a:samlify_project:samlify:*:*:*:*:*:*:*:*
First Time Samlify Project
Samlify Project samlify
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
References () https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m - () https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m - Exploit, Vendor Advisory

09 Jun 2026, 16:16

Type Values Removed Values Added
References () https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m - () https://github.com/tngan/samlify/security/advisories/GHSA-34r5-q4jw-r36m -

08 Jun 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-08 19:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-46490

Mitre link : CVE-2026-46490

CVE.ORG link : CVE-2026-46490

JSON object : View

Products Affected

samlify_project

  • samlify
CWE
CWE-91

XML Injection (aka Blind XPath Injection)