Authentication Bypass in github.com/russellhaering/gosaml2
Date: 2022-02
Affected: go/github.com/russellhaering/gosaml2
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2020-29509
CWE: CWE-115
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Impact Given a valid SAML Response, it may be possible for an attacker to mutate the XML document in such a way that gosaml2 will trust a different portion of the document than was signed. Depending on the implementation of the Service Provider this enables a variety of attacks, including users accessing accounts other than the one to which they authenticated in the Identity Provider, or full authentication bypass. ### Patches Service Providers utilizing gosaml2 should upgrade to v0.6.0 or greater.


Mitigations:

Architectural layers (MAESTRO):