CVE-2026-46490

The flaw

samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted into element text (e.g., <saml:AttributeValue>) are not escaped. A normal user c

What to do

Review advisory and patch per vendor guidance.

References