Skip to main content
cve.nowby Sazabi
← Vulnerabilities
GO-2026-6909

Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

Exploited
No known exploitation
Fix
No fix listed
Who is exposed
Not reported
Published
Last modified
15/100 · provisional
None on Exploit-DB, Metasploit or GitHub

Summary

The crewjam/saml Go library, which handles SAML assertion processing, has a flaw where a signed assertion that omits the optional Issuer element causes a nil-pointer panic that can crash the service. A separate flaw lets an already-authenticated user spoof the subject's NameID value by including a NameID element from a foreign XML namespace that the library mistakenly accepts.

Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.

Read the original description

github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:

  1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional <saml:Issuer> element causes a nil-pointer dereference panic after signature verification.
  2. Subject uses the bare XML struct tag xml:"NameID", which matches <NameID> elements in any XML namespace. When a signed assertion omits <saml:NameID> and includes a <NameID> element in a foreign namespace inside <saml:Subject>, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.

cve.now Index

15Pcve.now Index 15 of 100 · methodology v3 · provisional
  • Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
  • Exposure?/25Unknown. No advisory context yet
  • Reach10/20Affects Go packages
  • Severity?/10Unknown. No CVSS score or vendor rating
  • No patch5/5No patch listed yet

What would change the score

  • Would score about 70 if added to CISA KEV
  • Would score about 65 if CISA's SSVC rates exploitation active
  • Would score about 37 if advisories confirm default setups are exposed

How the score works · Leaderboard

Timeline

  1. Advisory published
  2. Record last updated
  3. First seen by cve.now

Affected versions

  • github.com/crewjam/samlGo

    All versions

Evidence 1

  1. Report

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about GO-2026-6909

Is GO-2026-6909 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by GO-2026-6909?

github.com/crewjam/saml (Go): all versions.Source: cve.now feed data

Sources

More vulnerabilities