---
id: "TECH-202610-xml-signature-wrapping-lets-attackers-bypass-login-in-apps-u"
kind: "technique"
aliases: []
title: "XML Signature Wrapping lets attackers bypass login in apps using Moldova's MPass SAML NuGet library (Egov.Integrations.MPass.Saml before 10.0.4)"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Egov.Integrations.MPass.Saml", "fixed": ["10.0.4"], "affected": "<10.0.4", "ecosystem": "nuget"}, {"name": "MPass (Moldova e-government SSO)", "fixed": [], "vendor": "Moldova e-Government Agency"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-29T01:20:06+00:00"
updated_at: "2026-10-29T01:20:06+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-29T01:20:06+00:00"}]
---

# XML Signature Wrapping lets attackers bypass login in apps using Moldova's MPass SAML NuGet library (Egov.Integrations.MPass.Saml before 10.0.4)

Egov.Integrations.MPass.Saml is the ASP.NET Core handler that relying-party apps use to check SAML 2.0 responses from Moldova's MPass government login. Every version before 10.0.4 checks the signature with SignedXml.CheckSignature(publicCertificate, verifySignatureOnly: true). That call only confirms that the references in SignedInfo are validly signed. It does not tie the signed element to the assertion the app then reads. As a result, an attacker can wrap a validly signed response around a forged assertion (XML Signature Wrapping) and log in as another user. Anyone running an ASP.NET Core app that accepts MPass logins through this package is at risk. A researcher disclosed it on r/netsec on 2026-10-29 with code-level detail. A CVE has been requested (CAN-2026-2041077) and the fix is in 10.0.4. No attacks have been reported; exploitation in the wild is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Egov.Integrations.MPass.Saml affected <10.0.4 fixed 10.0.4
- :MPass (Moldova e-government SSO) affected ? fixed ?

## How to check

Look for the NuGet package Egov.Integrations.MPass.Saml at any version below 10.0.4 in .csproj, Directory.Packages.props or packages.lock.json. Look for SignedXml.CheckSignature(..., verifySignatureOnly: true) in custom SAML verification code. Look in auth logs for MPass SAML responses with more than one Assertion element or with unexpected extra elements.

## Fix

Upgrade Egov.Integrations.MPass.Saml to 10.0.4 or later and redeploy. Check recent MPass logins for impersonation where you can.

## Timeline

- 2026-10-29T01:20:06+00:00 analyst

## Documents

- [describes] r/netsec: XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet library, fixed in 10.0.4 (CVE requested, CAN-2026-2041077) https://www.reddit.com/r/netsec/comments/1xi65vs/xml_signature_wrapping_authentication_bypass_in/
- [describes] @_r_netsec: XML Signature Wrapping authentication bypass in Moldova's MPass SAML NuGet libra https://x.com/_r_netsec/status/2115610404693131510

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_