CVE-2025-47949: samlify SAML Signature Wrapping attack

May 19, 2025 (updated October 31, 2025)

A Signature Wrapping attack has been found in samlify <v2.10.0, allowing an attacker to forge a SAML Response to authenticate as any user. An attacker would need a signed XML document by the identity provider.

References

github.com/advisories/GHSA-r683-v43c-6xqv
github.com/tngan/samlify
github.com/tngan/samlify/commit/115679acd89f0a37ea3ebd8fff7db54fca3e8af3
github.com/tngan/samlify/security/advisories/GHSA-r683-v43c-6xqv
nvd.nist.gov/vuln/detail/CVE-2025-47949

Code Behaviors & Features

Detect and mitigate CVE-2025-47949 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →