A severe authentication bypass vulnerability in Samlify, tracked as CVE-2025-47949, has been discovered that enables attackers to impersonate administrators by injecting unsigned malicious assertions into legitimately signed SAML responses.
## What is Samlify?
Samlify is a popular high-level authentication library that helps developers integrate SAML Single Sign-On (SSO) and Single Log-Out (SLO) into Node.js applications. With over 200,000 weekly downloads on npm, it’s widely used by:
– SaaS platforms
– Organizations implementing SSO for internal tools
– Developers integrating with corporate Identity Providers like Azure AD or Okta
– Federated identity management systems
## The Vulnerability
The flaw, which received a critical CVSS v4.0 score of 9.9, affects all Samlify versions prior to 2.10.0. EndorLabs identified this as a Signature Wrapping vulnerability where:
1. Samlify correctly verifies that the XML document providing a user’s identity is signed
2. However, it proceeds to read fake assertions from unsigned parts of the XML
An attacker with access to a valid signed SAML response (through interception or public metadata) can modify it by inserting a malicious SAML Assertion containing an administrator’s username. While the original signature remains valid for the benign part of the document, the vulnerable parsing logic processes the unsigned, malicious assertion.
## Impact
This vulnerability represents a complete SSO bypass that allows:
– Unauthorized remote attackers to perform privilege escalation
– Authentication as administrators without user interaction
– Relatively simple exploitation requiring only access to a valid signed XML blob
## Mitigation
Users should immediately upgrade to Samlify version 2.10.0, which was released earlier this month. While GitHub still offers 2.9.1 as the latest version, npm hosts the secure 2.10.0 version.
Although there have been no reports of active exploitation in the wild, affected users are strongly advised to take immediate action to secure their environments.