Summary samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., ) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and ad…
| CVE ID | CVE-2026-46490 |
| Vendor | npm |
| Affected Product | samlify |
| Vulnerability Type | Vulnerability |
| CVSS Score | 7.5 (HIGH) |
| Actively Exploited | ❌ No known exploitation |
| Patch Status | See Vendor Advisory → |
| Reported By | CYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories) |
#
) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups).src/libsaml.ts → replaceTagsByValue() only escapes placeholders when preceded by a quote (attribute context). Element text is inserted raw. The attribute builder inserts placeholders into element text: `` {attrUserX} ` Therefore, … is accepted and signed.im
Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.