CVE-2026-46490: XML Injection in samlify SAML Library Enables Privilege Escalation

Technical summary

CVE-2026-46490 is an XML injection vulnerability in samlify versions prior to 2.13.0. The library's template substitution logic escapes values only in attribute contexts but fails to escape values inserted into element text nodes. An authenticated attacker can inject XML markup into SAML attribute values (such as email or name fields) to create new <saml:Attribute> elements within the signed assertion. Because the assertion is cryptographically signed by the identity provider, the service provider treats the injected attributes as authentic. This bypasses trust boundaries when attributes are used for authorization decisions.

Business impact

Organizations deploying samlify for federated authentication face a critical insider threat vector. Authenticated users—including contractors, ex-employees with lingering access, or compromised accounts—can escalate their privileges by injecting role or group attributes into their own SAML assertions. If applications use SAML attributes to gate access to sensitive features, data, or administrative functions, attackers can gain unauthorized access without needing to compromise the identity provider itself. This is particularly severe in multi-tenant or cloud environments where attribute-based access control is a key security boundary.

Affected systems

samlify versions below 2.13.0 are vulnerable. This includes all applications and platforms that integrate samlify as a dependency for SAML service provider functionality. The vulnerability requires the attacker to have valid credentials to initiate authentication, limiting exposure to users with existing accounts. Applications using samlify with role-based or attribute-based authorization are at highest risk.

Exploitability

Exploitability is high in practical scenarios. The attack requires the attacker to be an authenticated user (PR:L), but no user interaction is needed after authentication (UI:N). The vulnerability is network-accessible (AV:N) and does not require special conditions (AC:L). An attacker with any valid login can craft a malicious attribute value during authentication and achieve privilege escalation. No authentication bypass is required—the exploit leverages existing trust in the SAML signing process.

Remediation

Upgrade samlify to version 2.13.0 or later. This version implements proper output encoding for all template substitution contexts, including element text nodes. Organizations should inventory all applications and services using samlify as a direct or transitive dependency and prioritize patching in environments where SAML attributes drive authorization decisions. Verify the patch by checking release notes and confirming the version constraint in package-lock.json or equivalent dependency manifests.

Patch guidance

Apply version 2.13.0 as the minimum safe version. Update your package.json dependency constraint for samlify to >=2.13.0. Run npm audit after updating to confirm no other vulnerabilities are introduced. Test federated authentication flows in a staging environment to verify that legitimate SAML assertions are still processed correctly after the upgrade. For applications with pinned versions, carefully update to 2.13.0 and validate against your SAML IdP and any custom assertion handling.

Detection guidance

Monitor authentication logs for unusual or malformed SAML assertions being processed by samlify instances. Look for attribute values containing XML special characters or markup (<, >, &) in fields that should contain plain text (email, name, etc.). Analyze SAML assertions logged by the service provider for unexpected attributes that do not originate from your identity provider configuration. Implement runtime validation of SAML attributes—reject any attribute structure that deviates from the IdP schema, particularly for authorization-critical attributes. Use SAML profiling or inspection tools to baseline normal assertion structure and alert on deviations.

Why prioritize this

This vulnerability merits immediate attention due to its CVSS score of 8.8 (HIGH), combined with practical exploitability by any authenticated user and direct impact on authorization. Unlike vulnerabilities requiring advanced attack chains, this flaw can be exploited with standard SAML tooling and basic XML knowledge. The attack surface includes all users with valid credentials, and the impact—privilege escalation via attribute injection—directly undermines access control. Organizations relying on SAML for multi-tenant or role-based security boundaries should treat this as a critical patch.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact (C:H, I:H, A:H) combined with low attack complexity and no required user interaction. The requirement for prior authentication (PR:L) prevents remote anonymous exploitation but does not reduce the score significantly, as any user can be an attacker. The unchanged scope (S:U) indicates the impact is limited to the vulnerable service, though in practice the blast radius depends on what the application does with trusted attributes. The score accurately represents the severity in typical SAML deployments.

Frequently asked questions