CVE-2026-89042: Krakenjs Passport-SAML-Encrypted

Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days.

passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

Affected products

• Krakenjs Passport-SAML-Encrypted: up to and including 0.1.13

Published 2026-09-10. Last modified 2026-09-11.