Identity CVE · SAML
CVE-2025-47949samlify signature wrapping, forge SAML as any user
critical
What broke
samlify below 2.10.0 did not correctly bind the XML signature to the assertion it later consumed. An attacker can wrap a valid signature around a new SAML response and authenticate as any user, including admins (CWE-347). Fixed in samlify 2.10.0.
Why it matters
The 2025 SAML story is not "Ruby is bad." It is that the most widely copied SSO libraries, in Ruby and in Node, failed the same signature-wrapping test. If your SP is a Node service using samlify (or a SaaS that embeds it), the blast radius matches ruby-saml. authentik later shipped its own ACS wrapping fix in 2025.12.5 / 2026.2.3 / 2026.5.1, which is the same pattern in a different codebase.
What to do
- Upgrade samlify to 2.10.0 or later. Check lockfiles, not just package.json ranges.
- Rotate IdP signing keys after the upgrade if the ACS was public.
- Inventory Node SPs the same way you inventory Rails SPs.
npm ls samlifyin every SSO-facing service.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.