CVE-2025-54419: 
JavaScript vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-54419) was discovered in Node-SAML, a SAML library for Node.js, affecting versions up to 5.0.1. The vulnerability allows attackers to modify authentication details within valid SAML assertions due to improper verification of signed content. The issue was discovered and disclosed on July 28, 2025, and has been assigned a CVSS score of 10.0 (Critical) (Security Online, GitHub Advisory).

The vulnerability stems from Node-SAML loading assertions from unsigned original response documents instead of verifying the signed portions. When checking signatures, the library processes different parts than those used for authentication, creating a security gap. This implementation flaw allows manipulation of authentication details within valid SAML assertions without invalidating the signature. The vulnerability has been assigned CWE-287 (Improper Authentication) and CWE-347 (Improper Verification of Cryptographic Signature) classifications (NVD).

The vulnerability enables attackers to modify authentication details within valid SAML assertions, potentially leading to authentication bypass in SAML 2.0 web applications. For example, attackers can remove characters from SAML assertion usernames, potentially manipulating user identities. With over 258,000 downloads per week, this vulnerability poses a significant risk to applications using Node-SAML for authentication (Security Online).

To exploit this vulnerability, an attacker needs access to a validly signed document from the identity provider (IdP). Once obtained, the attacker can modify authentication details within the SAML assertion without invalidating the signature, potentially leading to unauthorized access (GitHub Advisory).

The vulnerability has been patched in Node-SAML version 5.1.0. The fix ensures that SAML assertions are processed only from verified/authenticated contents, preventing unauthorized modifications. Users are strongly advised to upgrade to version 5.1.0 or later (GitHub Release, GitHub Advisory).