Full Report
A critical Samlify authentication bypass vulnerability has been discovered that allows attackers to impersonate admin users by injecting unsigned malicious assertions into legitimately signed SAML responses. [...]
Analysis Summary
# Vulnerability: Critical Samlify SSO Bypass Leading to Admin Login (Signature Wrapping)
## CVE Details
- CVE ID: CVE-2025-47949
- CVSS Score: 9.9 (Critical) (Based on CVSS v4.0)
- CWE: Not explicitly stated, but describes an XML Signature Wrapping/Parsing flaw.
## Affected Systems
- Products: Samlify (A SAML library/tool)
- Versions: All versions before 2.10.0.
- Configurations: Systems utilizing Samlify for SAML Single Sign-On (SSO) processing.
## Vulnerability Description
The vulnerability is a critical Signature Wrapping flaw stemming from how Samlify parses XML documents containing SAML assertions. The library correctly verifies the signature on the provided XML document. However, it then proceeds to process and trust assertions found in an unsigned/unvalidated portion of the XML structure.
An attacker can take a legitimately signed SAML response (which can sometimes be obtained via public metadata or intercepted communications) and insert a second, malicious SAML Assertion containing the identity of a target user (e.g., an administrator's username). Because the original valid signature still covers a benign part of the XML, the vulnerable parsing logic processes the malicious, unsigned assertion, resulting in an unauthenticated SSO bypass and immediate privilege escalation to the targeted user's level (including administrator).
## Exploitation
- Status: Not exploited in the wild (as of article publication).
- Complexity: Low (Requires access to a valid signed XML blob).
- Attack Vector: Network (Remote exploitation possible if the attacker can supply the malicious SAML response to the Service Provider).
## Impact
- Confidentiality: High (Full access to the session/account of the impersonated user).
- Integrity: High (Full control over the impersonated user's actions, including potential system changes).
- Availability: High (Can lead to service disruption through account takeover).
## Remediation
### Patches
- Upgrade to **SAMLify version 2.10.0** or later.
### Workarounds
- No specific workarounds were mentioned, but immediate patching is strongly advised due to the critical nature of the flaw.
## Detection
- Detection information was not explicitly detailed in the provided summary.
- **Mitigation Focus:** Monitoring SAML requests for unexpected or malformed XML structures containing multiple assertions, especially those where logic might appear to process unsigned data immediately following a signature verification process.
## References
- Vendor Advisory (Implied by EndorLabs report): hxxps://www.endorlabs.com/learn/cve-2025-47949-reveals-flaw-in-samlify-that-opens-door-to-saml-single-sign-on-bypass
- NPM Package: hxxps://www.npmjs.com/package/samlify
- GitHub Releases: hxxps://github.com/tngan/samlify/releases