Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N N H N 8.7 .0047 38.8 —
AFFECTED Product Versions Fixed samlify < 2.13.0 – —
TIMELINE May 14 Reserved by GitHub_M Jun 8 EXPLOIT PUBLISHED — CVE-2026-46490 (tngan samlify). Public exploit reference added. Jun 8 Published (CNA: GitHub_M)
samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user can inject XML markup into an attribute value (e.g., email, name) and add new <saml:Attribute> elements inside the signed assertion. The IdP then signs the tampered assertion and the SP accepts the injected attributes as trusted. This allows privilege escalation when attributes are used for authorization (roles/groups). This issue has been patched in version 2.13.0.
| Date | Event | Detail |
|---|---|---|
| May 14, 2026 | Reserved | Reserved by GitHub_M |
| June 8, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-46490 (tngan samlify). Public exploit reference added. |
| June 8, 2026 | Published | Published (CNA: GitHub_M) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| tngan | samlify | — | < 2.13.0 | — |
Authoritative record: CVE-2026-46490 at cve.org
Vendors: tngan
Weaknesses: CWE-91
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-46490 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.