GITHUB.COM/CREWJAM/SAML · GO-2026-6909 · Package
NO FIX YET
github.com/crewjam/saml through v0.5.1 crashes when a signed SAML assertion omits the Issuer element and an expected IdP entity ID is set. It also lets a signed assertion with a foreign-namespace NameID element spoof the subject name ID, so an authenticated user could impersonate another identity.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use github.com/crewjam/saml as a SAML service provider and set ExpectedIDPEntityID are exposed to the panic. Applications that read Subject.NameID for identity are exposed to the spoofing issue, since an authenticated principal can influence it. Services that do not use this library, or that do not process SAML assertions, can skip it.
Not affected if no-saml-usage, not-service-provider
Who cares crewjam-saml, go, saml, sso
github.com/crewjam/saml with go list -m github.com/crewjam/samlv0.5.1 or earlierNo fix yet, per the sources.
github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:
ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional saml:Issuer element causes a nil-pointer dereference panic after signature verification.
Subject uses the bare XML struct tag xml:"NameID", which matches <NameID> elements in any XML namespace. When a signed assertion omits saml:NameID and includes a <NameID> element in a foreign namespace inside saml:Subject, encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.