https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sat, 04 Jul 2026 02:44:38 +0000 https://vulnerability.circl.lu/sighting/c73ce6f8-367c-4d28-b404-678b1c2befcc/export {"uuid": "c73ce6f8-367c-4d28-b404-678b1c2befcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WJMP-WPHQ-JVQF", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/16202", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-46572\n\ud83d\udd25 CVSS Score: 9.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. Users are affected specifically when the service provider is using passport-wsfed-saml2 and a valid SAML document signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.\n\ud83d\udccf Published: 2025-05-06T20:18:26.379Z\n\ud83d\udccf Modified: 2025-05-13T19:17:06.822Z\n\ud83d\udd17 References:\n1. https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-wjmp-wphq-jvqf\n2. https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181", "creation_timestamp": "2025-05-13T19:30:57.000000Z"} {"uuid": "c73ce6f8-367c-4d28-b404-678b1c2befcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WJMP-WPHQ-JVQF", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/16202", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-46572\n\ud83d\udd25 CVSS Score: 9.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a valid SAML object that was signed by the configured IdP. Users are affected specifically when the service provider is using passport-wsfed-saml2 and a valid SAML document signed by the Identity Provider can be obtained. Version 4.6.4 contains a fix for the vulnerability.\n\ud83d\udccf Published: 2025-05-06T20:18:26.379Z\n\ud83d\udccf Modified: 2025-05-13T19:17:06.822Z\n\ud83d\udd17 References:\n1. https://github.com/auth0/passport-wsfed-saml2/security/advisories/GHSA-wjmp-wphq-jvqf\n2. https://github.com/auth0/passport-wsfed-saml2/commit/e5cf3cc2a53748207f7a81bfba9195c8efa94181", "creation_timestamp": "2025-05-13T19:30:57.000000Z"} https://vulnerability.circl.lu/sighting/c73ce6f8-367c-4d28-b404-678b1c2befcc/export Tue, 13 May 2025 19:30:57 +0000