CVE-2026-89043: Krakenjs Passport-SAML-Encrypted

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.

Affected products

• Krakenjs Passport-SAML-Encrypted: up to and including 0.1.13

Published 2026-09-10. Last modified 2026-09-10.