Is CVE-2026-89043 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-89043?

CVE-2026-89043 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-89043

Description

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets accepted as the verified identity while the genuine signature validates against the original assertion.