SAMLStorm

What happened?

SAMLStorm is a pair of critical vulnerabilities in xml-crypto (≤ 6.0.0) and node-saml that allow a logged-in user to impersonate any other user — including administrators — without knowing their credentials or breaking any cryptography.

The attack works because the signature verification library (xml-crypto) and the assertion extraction library (node-saml) read different parts of the same XML document. The attacker exploits this split perspective to pass a valid signature check while the assertion content has already been swapped.

The Trust Chain

The SP only trusts an assertion because a cryptographic chain secures it. This is how it's supposed to work:

Each link secures the next. The DigestValue is the hash of the assertion. Change the assertion and the hash no longer matches — the signature check fails.

SAMLStorm breaks this chain — not through cryptography, but because xml-crypto and node-saml read different parts of the same document.

DigestValue Comment Injection

xml-crypto reads the DigestValue as a text node. When an XML comment is injected inside the element, it only reads the text after the comment — the real hash. But the assertion content has already been changed.

What xml-crypto sees: jMHaXYxasIl3oc5Q+VW0UYUCY6s= — the real hash. Check passes.

What node-saml extracts from the assertion: admin as the NameID.

serialize user {
  nameID: 'admin',        ← logged in as user1, arrived as admin
  uid: 'admin',
  email: 'user1@company.com',  ← IdP attributes still from user1
  eduPersonAffiliation: 'group1',
}

Duplicate SignedInfo

xml-crypto and node-saml process the XML independently. When two SignedInfo nodes exist in the document, each library looks at a different one.

<ds:Signature>

  <FakeWrapper>                   <!-- injected by attacker -->
    <ds:SignedInfo>               <!-- xml-crypto validates THIS one -->
      <ds:Reference URI="#fake">
        <ds:DigestValue>
          47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
          <!-- SHA256 of empty string — predictable, always the same -->
        </ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
  </FakeWrapper>

  <ds:SignedInfo>               <!-- node-saml reads THIS one -->
    <ds:Reference URI="#realAssertion">
      <ds:DigestValue>real hash...</ds:DigestValue>
    </ds:Reference>
  </ds:SignedInfo>

</ds:Signature>

<saml:Assertion>
  <saml:NameID>admin</saml:NameID>   <!-- swapped by attacker -->
</saml:Assertion>

One version number apart

xml-crypto 6.0.1 was released the same day as the CVE disclosure — March 2025.

The Fragile Lock — December 2025

PortSwigger Research extended the same attack class to Ruby and PHP stacks. The common root is identical.

Quiz