crewjam/saml vulnerable to signature bypass via multiple Assertion elements due to improper authentication
Date: 2022-11
Affected: go/github.com/crewjam/saml
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2022-41912
CWE: CWE-287
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

### Impact The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. ### Patches This issue has been corrected in version 0.4.9. ### Credit This issue was reported by Felix Wilhelm from Google Project Zero.


Mitigations:

Architectural layers (MAESTRO):