7.5

CVE-2022-23505: auth0 passport-wsfed-saml2 Improper Authentication

CVSS: 7.5v3.1HighModified
AliasesGHSA-ppjq-qxhx-m25f
Published 13-12-2022Last modified 23-04-2025
Open JSON

Vulnerability summary

CVE-2022-23505 is a high (CVSS 7.5) Improper Authentication vulnerability in auth0 passport-wsfed-saml2. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 55.8% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.80%
0%100%
Low · +0.05 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 13-12-2022
    PublishedVulnerability first disclosed.
  2. 23-04-2025
    Last modifiedVulnerability information updated.

Description

Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be able to bypass WSFed authentication on a website using passport-wsfed-saml2. A successful attack requires that the attacker is in possession of an arbitrary IDP signed assertion. Depending on the IDP used, fully unauthenticated attacks (e.g without access to a valid user) might also be feasible if generation of a signed message can be triggered. This issue is patched in version 4.6.3. Use of SAML2 authentication instead of WSFed is a workaround.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

+0.05 pp

From 0.75% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Auth01 product
Npm1 product
  • passport-wsfed-saml2< 4.6.3

2 vendors · 2 products

References

4 links