Authentication bypass is possible when processing SAML responses containing multiple Assertion elements.
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2022-1129" }
{ "imports": [ { "path": "github.com/crewjam/saml", "symbols": [ "ServiceProvider.ParseResponse", "ServiceProvider.ParseXMLArtifactResponse", "ServiceProvider.ParseXMLResponse", "ServiceProvider.ValidateLogoutResponseForm", "ServiceProvider.ValidateLogoutResponseRedirect", "ServiceProvider.ValidateLogoutResponseRequest", "ServiceProvider.validateSignature", "findChild" ] } ] }