CVE-2017-16897

Published: Dec 27, 2017Modified: May 13, 2026

8.1

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

A vulnerability has been discovered in the Auth0 passport-wsfed-saml2 library affecting versions < 3.0.5. This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider does not sign the full SAML response (e.g., only signs the assertion within the response).

Affected (1)

Products: Auth0: Passport Wsfed Saml2

1 product

Passport Wsfed Saml2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Auth0 Passport Wsfed Saml2	Before 3.0.5

Related CWEs

Authentication Bypass by Spoofing

This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (2)

https://auth0.com/docs/security/bulletins/cve-2017-16897

Source: cve@mitre.org

Vendor Advisory

https://auth0.com/docs/security/bulletins/cve-2017-16897

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.