CVE-2025-24895

CVE-2025-24895 is a critical authentication bypass vulnerability in CIE.AspNetCore.Authentication, an AspNetCore Remote Authenticator for CIE 3.0, affecting Service Providers (SPs) that validate SAML assertions. The flaw allows an attacker to inject a signed XML element, bypassing proper signature verification for subsequent elements within a SAML response. This enables an attacker to impersonate any Spid and/or CIE user, leading to unauthorized access. With a CVSS score of 9.1 (Critical), this vulnerability has a network attack vector and low attack complexity, requiring no user interaction. The potential impact is high confidentiality and integrity compromise, as attackers can fully impersonate legitimate users. There are no known workarounds, and users are advised to upgrade to version 2.1.0 or later. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. However, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.