Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

Published 7 y ago 2019-04-17 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.7

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 61%

Public exploits

none known

Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Exploit prediction (EPSS)

0.94% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	7.7	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`
NVD	3.1	7.5	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`
CNA	3.0	7.7	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:N/I:P/A:N`

Affected products

Duo Security Duo Network Gateway

Classification

Weakness

CWE-287 Improper Authentication
CWE-347 Improper Verification of Cryptographic Signature

References

duo.com /blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations · x_refsource_MISC, x_transferred
kb.cert.org /vuls/id/475445 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-7340
NVD: CVE-2018-7340

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.