Zero Radar
← feed
CriticalVulnerabilityupdated 29 Oct 2026, 01:04 UTC

MPass SAML library for .NET can let attackers log in as other users

Websites that use this login library may accept a forged login message, letting an attacker sign in as someone else. Updating the library closes the gap.

Fixed in 10.0.4 and 10.0.5Unverified
SeverityCriticalVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?Yes10.0.4 and 10.0.5 · since 29 Oct 2026
How sure is this?UnverifiedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker obtains a signed messageNeeds one validly signed MPass response
  2. 2Elements are relocatedSigned part moved, forged assertion placed at root
  3. 3Signature check passesLibrary only checks referenced parts are signed
  4. 4Login as another userApp trusts the forged root element
  5. ResultAttacker signs in as an arbitrary user

What happened

The Egov.Integrations.MPass.Saml NuGet library verifies a signature that covers only some parts of a SAML response, so an attacker holding one validly signed message can move the signed element and insert chosen assertion content, a signature wrapping attack.

Why it is dangerous: A successful attack gives authentication as an arbitrary user of a relying party site, which can expose accounts and data.

Are you affected?

You are affected if your application uses the Egov.Integrations.MPass.Saml NuGet package in versions 8.0.53 to 8.0.56 or 10.0.2.

Egov.Integrations.MPass.Saml 8.0.53 to 8.0.56; 10.0.2

What to do

  1. Update Egov.Integrations.MPass.Saml to version 10.0.4 or 10.0.5
  2. Rebuild and redeploy any application that uses the MPass SAML handler
  3. Review logs for unexpected logins while the vulnerable version was in use

Timeline

  1. 29 Oct 2026, 01:00 UTC
    Publicly disclosed
  2. 29 Oct 2026, 01:00 UTC
    Reported by r/netsec · r/netsec
  3. 29 Oct 2026, 01:04 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Community discussion sites, treat with care

Technical details

ID
ZR-6da15508
Disclosed
29 Oct 2026, 01:00 UTC
On Zero Radar
29 Oct 2026, 01:04 UTC (4 min after disclosure)
Last change
29 Oct 2026, 01:04 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

MPass SAML library for .NET can let attackers log in as other users · Zero Radar