{"id":"GO-2026-6909","kind":"vulnerability","aliases":["GO-2026-6909"],"related":[],"title":"Nil-pointer panic in validateAssertion and namespace-blind Subject.NameID in github.com/crewjam/saml","description":"github.com/crewjam/saml through v0.5.1 contains two vulnerabilities in SAML assertion processing:\n\n1. ServiceProvider.validateAssertion dereferences assertion.Issuer without a nil check when ExpectedIDPEntityID is non-empty. A signed SAML assertion that omits the optional element causes a nil-pointer dereference panic after signature verification.\n\n2. Subject uses the bare XML struct tag xml:\"NameID\", which matches elements in any XML namespace. When a signed assertion omits and includes a element in a foreign namespace inside , encoding/xml populates Subject.NameID from the foreign element, allowing an authenticated principal to spoof Subject.NameID.Value.","summary":"github.com/crewjam/saml through v0.5.1 crashes when a signed SAML assertion omits the Issuer element and an expected IdP entity ID is set. It also lets a signed assertion with a foreign-namespace NameID element spoof the subject name ID, so an authenticated user could impersonate another identity.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/crewjam/saml","fixed":[],"affected":"all versions","ecosystem":"go"}],"ecosystems":["go"],"tags":["crewjam-saml","go","package","saml","sso"],"not_affected_if":["no-saml-usage","not-service-provider"],"how_to_check":"- Check whether the project depends on `github.com/crewjam/saml` with `go list -m github.com/crewjam/saml`\n- Confirm the resolved version is `v0.5.1` or earlier","fix":null,"status":"open","published_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","triaged_at":"2026-11-06T00:10:30+00:00","updated_at":"2026-11-06T00:10:30+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T00:10:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Go SAML library: nil-pointer panic and spoofable subject name ID","impact":"medium","summary":"github.com/crewjam/saml through v0.5.1 crashes when a signed SAML assertion omits the Issuer element and an expected IdP entity ID is set. It also lets a signed assertion with a foreign-namespace NameID element spoof the subject name ID, so an authenticated user could impersonate another identity.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","saml","sso","crewjam-saml"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Process crashes via panic; identity spoofed via subject name ID","analyst_note":"Fixed version not stated in the sources; check https://pkg.go.dev/vuln/GO-2026-6909 for the first fixed release and confirm whether the NameID issue needs a signed assertion from a trusted IdP.","how_to_check":"- Check whether the project depends on `github.com/crewjam/saml` with `go list -m github.com/crewjam/saml`\n- Confirm the resolved version is `v0.5.1` or earlier","plain_action":"","needs_analyst":true,"not_affected_if":["no-saml-usage","not-service-provider"],"who_is_affected":"Applications that use github.com/crewjam/saml as a SAML service provider and set ExpectedIDPEntityID are exposed to the panic. Applications that read Subject.NameID for identity are exposed to the spoofing issue, since an authenticated principal can influence it. Services that do not use this library, or that do not process SAML assertions, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000751,"input_tokens":4410,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-6909':18A,21A '/crewjam/saml':15A,24A,34B,83C '1':93C '2':126C 'allow':164C 'also':56B 'anoth':79B 'assert':42B,60B,91C,110C,146C 'assertion.issuer':96C 'authent':75B,166C 'bare':130C 'blind':10A 'caus':116C 'check':100C 'contain':86C 'could':77B 'crash':37B 'crewjam':26B 'crewjam-saml':25B 'derefer':95C,121C 'element':46B,67B,115C,138C,151C,163C 'empti':106C 'encoding/xml':157C 'entiti':51B 'expect':49B 'expectedidpentityid':102C 'foreign':64B,154C,162C 'foreign-namespac':63B 'github.com':14A,23A,33B,82C 'github.com/crewjam/saml':13A,22A,32B,81C 'go':16A,19A,28B 'id':52B,72B 'ident':80B 'idp':50B 'imperson':78B 'includ':149C 'insid':156C 'issuer':45B 'let':57B 'match':137C 'name':71B 'nameid':66B,135C 'namespac':9A,65B,142C,155C 'namespace-blind':8A 'nil':2A,99C,119C 'nil-point':1A,118C 'non':105C 'non-empti':104C 'omit':43B,112C,147C 'option':114C 'packag':29B 'panic':4A,122C 'pointer':3A,120C 'popul':158C 'princip':167C 'process':92C 'saml':27B,30B,41B,90C,109C 'serviceprovider.validateassertion':94C 'set':54B 'sign':40B,59B,108C,145C 'signatur':124C 'spoof':68B,169C 'sso':31B 'struct':132C 'subject':70B,127C 'subject.nameid':11A,159C 'subject.nameid.value':170C 'tag':133C 'two':87C 'use':128C 'user':76B 'v0.5.1':36B,85C 'validateassert':6A 'verif':125C 'vulner':88C 'without':97C 'xml':131C,134C,141C","nicknames":[],"mitigations":[],"who_affected":"Applications that use github.com/crewjam/saml as a SAML service provider and set ExpectedIDPEntityID are exposed to the panic. Applications that read Subject.NameID for identity are exposed to the spoofing issue, since an authenticated principal can influence it. Services that do not use this library, or that do not process SAML assertions, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["githubcomcrewjamsaml"],"ptokens":["com","crewjam","github","saml"],"labels":["crewjamsaml","go","package","saml","sso","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T22:55:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6909","url":"https://pkg.go.dev/vuln/GO-2026-6909","severity":null,"published_at":"2026-11-05T22:55:15+00:00","modified_at":"2026-11-05T22:55:15+00:00","first_seen_at":"2026-11-06T00:09:14+00:00","fetched_at":"2026-11-06T00:09:14+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}