CVE-2026-89043

HighCVSS 7.4/10Last modified Sep 10, 2026

Description

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-890446.5Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding CVE-2026-890454.0zstd-jni versions 1.4.8-4 through 1.5.7-13 fail to validate negative length parameters in ZstdInputStreamNoFinalizer.read(), allowing attack CVE-2026-890468.2zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate ne CVE-2026-890476.1The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all ve CVE-2026-890499.9A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts CVE-2026-89056.1The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This CVE-2026-890504.3The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gatewa CVE-2026-890517.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHead CVE-2026-890525.9A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across dev CVE-2026-890548.2A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for CVE-2026-890559.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.CVE-2026-890576.8A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una