XML Signature Wrapping lets attackers bypass login in apps using Moldova's MPass SAML NuGet library (Egov.Integrations.MPass.Saml before 10.0.4)

Egov.Integrations.MPass.Saml is the ASP.NET Core handler that relying-party apps use to check SAML 2.0 responses from Moldova's MPass government login. Every version before 10.0.4 checks the signature with SignedXml.CheckSignature(publicCertificate, verifySignatureOnly: true). That call only confirms that the references in SignedInfo are validly signed. It does not tie the signed element to the assertion the app then reads. As a result, an attacker can wrap a validly signed response around a forged assertion (XML Signature Wrapping) and log in as another user. Anyone running an ASP.NET Core app that accepts MPass logins through this package is at risk. A researcher disclosed it on r/netsec on 2026-10-29 with code-level detail. A CVE has been requested (CAN-2026-2041077) and the fix is in 10.0.4. No attacks have been reported; exploitation in the wild is unknown.

Summary written from the sources below. Check the originals before acting.