Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| auth0 | passport-wsfed-saml2 | affected |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-7706 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround. |
 Github GHSA |
GHSA-ppjq-qxhx-m25f | Authentication Bypass for passport-wsfed-saml2 |
No history.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-04-23T16:28:35.321Z
Reserved: 2022-01-19T21:23:53.773Z
Link: CVE-2022-23505
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-12-13T08:15:09.067
Modified: 2024-11-21T06:48:42.253
Link: CVE-2022-23505
Redhat
No data.
OpenCVE Enrichment
No data.