Third-party cyber evaluations involving OpenAI models
openai.com·13h ago
Web Development
Vercel Blog·Mar 18·5 min read
Vercel Firewall protects against the SAMLStorm vulnerability
TL;DR
SAMLStorm is a vulnerability that affects SAML (Security Assertion Markup Language) authentication, potentially allowing unauthorized access. Vercel has implemented a new feature in its Vercel Firewall to specifically protect against this vulnerability.
✦ Why It Matters
Engineers can implement Vercel Firewall to enhance security against SAMLStorm vulnerabilities in their applications.
Key Takeaways
- Check your xml-crypto package version immediately.
- Update to xml-crypto versions 6.0.1, 3.2.1, or 2.1.6.
- Ensure your applications are protected against SAMLStorm.
- Stay informed about further security updates from Vercel.
Full Summary
A recent vulnerability known as SAMLStorm (CVE-2025-29774 and CVE-2025-29775) affects various implementations of SAML (Security Assertion Markup Language) and could allow attackers to bypass authentication processes. In response, Vercel has deployed an automatic security update to its Firewall, which mitigates this risk for users.
However, it is still crucial for developers using the xml-crypto package version 6.0.0 or earlier, or any dependent packages, to update to the patched versions 6.0.1, 3.2.1, or 2.1.6. This proactive measure ensures that applications remain secure against potential exploits.
Vercel will continue to monitor the situation and provide updates as necessary to maintain security.