External risk intelligence

Node-SAML Assertion Modification Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-54369

Node-SAML is a library used to handle authentication assertions. SAML is a foundational protocol for identity portals and single sign-on (SSO) systems, which are by design internet-facing, publicly reachable services that process authentication requests from users or external service providers.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in a SAML library used for authentication, allowing attackers to potentially alter user authentication details within legitimate assertion responses. This could impact systems relying on this library for identity verification and single sign-on. The main concern is confirming relevance and exposure to our identity and access management infrastructure.

Attackers can alter authentication details in SAML.
This affects how we verify user identities.
Confirm if our systems use this library.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by manipulating SAML authentication responses before they are fully verified. This allows for modifications to critical user information within the assertion, potentially leading to unauthorized access or impersonation.

No special access required.
Modifying unsigned assertion data.
Unauthorized user access or privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to modify authentication details within a SAML assertion, potentially altering user identities or permissions when supported by the advisory's context.

User identity or authentication details.
Attackers can modify assertions before verification.
Unauthorized access or privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Node-SAML library's handling of SAML assertions requires attention from teams responsible for identity and access management, particularly those overseeing single sign-on (SSO) solutions. The immediate priority is to inventory all systems utilizing this library, confirm their exposure and criticality, and identify the specific application or platform owners. Remediation planning should then align with identified risks and operational constraints.

Identify and confirm Node-SAML ownership.
Verify SAML assertion reachability and criticality.
Plan remediation based on risk and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Node-SAML?

Node-SAML is a JavaScript library specifically designed for Node.js environments. It facilitates the Security Assertion Markup Language (SAML) protocol, which allows developers to implement single sign-on (SSO) and exchange authentication data between an identity provider and a service provider. By handling the complex XML parsing and signature validation of SAML assertions, it helps applications verify user identity across different platforms.

What does CWE-347 and CWE-87 mean for CVE-2025-54369?

These weakness classifications highlight a failure in cryptographic verification and improper neutralization of input. In the context of this CVE, the library validates the signature of a SAML assertion but reads the actual user details from an unverified, unsigned portion of the document. This mismatch allows an attacker to manipulate the user's data while the overall signature remains technically valid, tricking the application into accepting altered credentials.

How does an attacker trigger this vulnerability?

An attacker triggers this by intercepting and modifying a SAML assertion during the authentication process. Because the library incorrectly pulls user data from the unsigned part of the document rather than the signed, verified part, the system accepts the tampered information. Simply sending a request that lacks a SAML assertion or failing to include a valid signature does not trigger this specific logic flaw; the assertion must be processed by the library.

Why does Halo Surface Signal categorize this as internet-facing?

Halo Surface Signal labels this as internet-facing because Node-SAML powers identity portals and single sign-on services. These components are intentionally exposed to the network to process authentication requests from users and external providers. Because these systems must be reachable to perform their primary function of logging users in, they are inherently situated in a position where external actors can interact with the authentication flow.

How do I respond if I use Node-SAML?

First, conduct an inventory to identify all internal applications that include Node-SAML as a dependency. Once identified, verify which version is currently running in your production environment. If you are using version 5.0.1 or below, the priority is to update to version 5.1.0 or higher, where this assertion handling issue has been addressed. Coordinate with your application owners to schedule this update to ensure identity verification processes remain secure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.