Passport-SAML Unsigned Response Bypass

Passport-SAML, a SAML authentication library for Node.js, is vulnerable in versions up to 0.1.13.

Attackers can bypass authentication by submitting unsigned SAML responses to the assertion consumer service endpoint, allowing them to receive authenticated profiles with arbitrary NameID and attributes.