Secuno
ENNL
Book demo

CVE-2026-46490

Samlify privilege escalation

8.8 HIGHPublic exploitEPSS 0.56%
  1. Published8 Jun 2026

Description

samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups). This issue has been patched in version 2.13.0.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Samlify< 2.13.0

Remediation

Fixed in
Samlify≥ 2.13.0

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1030449.8
XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation…
CVE-2026-557898.5
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to…
CVE-2026-111698.1
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a…
CVE-2026-401658.7
authentik is an open-source identity provider. Versions 2025.12.4 and prior, and…
CVE-2026-287708.8
Improper neutralization of special elements in the /IDC_Logging/checkifdone.cgi script…
CVE-2022-509028.4
Wondershare FamiSafe 1.0 contains an unquoted service path vulnerability in the…

Frequently asked

Is CVE-2026-46490 being actively exploited?

CVE-2026-46490 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.56%.

How severe is CVE-2026-46490?

CVE-2026-46490 has a CVSS 3.1 base score of 8.8, rated high. EPSS estimates a 0.56% probability of exploitation.

Which products are affected by CVE-2026-46490?

Affected products include Samlify.

How do I fix CVE-2026-46490?

Upgrade affected software to a fixed version, for example Samlify 2.13.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-46490 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.