Repository navigation
Security: tngan/samlify
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
Redirect and SimpleSign signatures are not bound to the parsed messageGHSA-wr2x-fh6q-q243 published
Oct 20, 2026 by tnganHigh -
samlify accepts an attacker-controlled signing certificate when IdP metadata uses RSAKeyValueGHSA-w8r9-gp23-wcxp published
Oct 20, 2026 by tnganCritical -
XML comment node-splitting in SP assertion extraction allows SAML impersonation and privilege escalationGHSA-963m-r92r-qm7c published
Oct 20, 2026 by tnganHigh -
Unbounded DEFLATE Inflation in SAML Redirect Binding Parser Leads to Remote Unauthenticated Denial of ServiceGHSA-3427-gh8x-vv2c published
Oct 20, 2026 by tnganHigh -
Signature wrapping bypass for LogoutRequest and AuthnRequestGHSA-63ch-w8pw-4mf2 published
Oct 20, 2026 by tnganModerate -
EncryptedAssertion decryption accepts RSA-1.5 key transport and TripleDES-CBCGHSA-3gg4-m4mq-vcxc published
Oct 20, 2026 by tnganModerate -
Missing InResponseTo validation enables SAMLResponse replay and IdP-initiated SSO bypassGHSA-wj54-2vfp-35f2 published
Oct 20, 2026 by tnganHigh -
Missing AudienceRestriction enforcement enables cross-SP account takeoverGHSA-wxh7-j2vx-w63f published
Oct 20, 2026 by tnganHigh -
samlify: CVE-2026-46490 fix escapes attribute values but leaves attribute metadata (name/nameFormat) unescapedGHSA-fq9x-v53h-7w5p published
Oct 20, 2026 by tnganModerate -
XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML AssertionsGHSA-34r5-q4jw-r36m published
May 14, 2026 by tnganHigh
Learn more about advisories related to tngan/samlify in the GitHub Advisory Database