CVE-2022-41912 CRITICAL

CVE-2022-41912: crewjam/saml go library is vulnerable to signature bypass via multiple Assertion elements

Vendor Crewjam

Product saml

Weakness CWE-287 · Improper authentication

Published November 28, 2022

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

The crewjam/saml go library prior to version 0.4.9 is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. This issue has been corrected in version 0.4.9. There are no workarounds other than upgrading to a fixed version.

Key dates

02Disclosure timeline

November 28, 2022 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-41912 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/287.html

Related vulnerabilities

04Related CVE

CVE-2026-45283 Nextcloud: Files Lock app allows users to lock and unlock files of other users CVE-2026-34123 Whitelist Validation Bypass in TP-Link Tapo C520WS CVE-2026-13543 Documenso Google OAuth Login handle-oauth-callback-url.ts improper authentication CVE-2026-45567 Roxy-WI: Authentication bypass via 'api' substring in URL + unauthenticated /api/gpt CVE-2026-10548 NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication