CVE-2026-89042 krakenjs CVE debrief

Who should care

Defenders who use the passport-saml-encrypted package should verify the authenticity of SAML responses and ensure that signature verification is not conditional on an optional cert option.

Why it matters

CVE-2026-89042 is a critical vulnerability in the passport-saml-encrypted package that allows attackers to bypass authentication by submitting unsigned SAML responses. Defenders should prioritize verifying the authenticity of SAML responses and ensuring that signature verification is not conditional on an optional cert option.

• Attackers can bypass authentication by submitting unsigned SAML responses
• Defenders must verify the authenticity of SAML responses
• Defenders must ensure that signature verification is not conditional on an optional cert option
• Defenders must update to a version of passport-saml-encrypted that requires signature verification

Technical summary

The passport-saml-encrypted package makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. This vulnerability, CVE-2026-89042, has a CVSS score of 9.3, indicating critical severity. Defenders should prioritize verifying the authenticity of SAML responses and ensuring that signature verification is not conditional on an optional cert option. The CVE record was published on 2026-09-10T18:18:15.910Z and was last modified on 2026-09-11T21:17:56.573Z.

Defensive priority

Defenders should prioritize verifying the authenticity of SAML responses and ensuring that signature verification is not conditional on an optional cert option.

Recommended defensive actions

• Verify the authenticity of SAML responses
• Ensure that signature verification is not conditional on an optional cert option
• Update to a version of passport-saml-encrypted that requires signature verification
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by the passport-saml-encrypted package making SAML signature verification conditional on an optional cert option. This allows attackers to bypass authentication by submitting unsigned SAML responses.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.