[GHSA-wjmp-wphq-jvqf] Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping #5508
Conversation
|
Hi there @kevinroh-okta! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
|
Hi @kevinroh-okta, I'm closing the PR since there aren't any changes to make to the global advisory GHSA-wjmp-wphq-jvqf, but the updated CVE description is now live at https://www.cve.org/CVERecord?id=CVE-2025-46572. As with #5509, it will take some time for the change to propagate to https://nvd.nist.gov/vuln/detail/CVE-2025-46572. |
|
@shelbyc can you update the CVSS score in the CVE so it reflects the global advisory of 9.3? |
|
@kevinroh-okta Sure! https://www.cve.org/CVERecord?id=CVE-2025-46572 is updated with the global advisory's CVSS now. |
Updates
Comments
The description for https://nvd.nist.gov/vuln/detail/CVE-2025-46572 does not match the description in this security advisory.
The description of the CVE is incorrect.
The bolded portion should be