Vulnerability · Published Mar 6, 2025 · Assigned by GitHub_M
CVE-2025-27509SAML authentication vulnerability due to improper SAML response validation
Critical 9.3
In plain English
A critical-severity security flaw in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | 4.64.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | 4.63.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | 4.62.4 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | 4.58.1 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | 4.53.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | no fix listed | GO-2025-3505 |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N