Hacker News with Generative AI: Zero-Day Vulnerability

SAMLStorm: Critical Authentication Bypass in XML-crypto and Node.js libraries (workos.com)
On Tuesday, March 4, 2025, WorkOS received a critical security report from researcher Alexander Tan (ahacker1) detailing a zero-day vulnerability in the widely used xml-crypto and SAML libraries in the Node.js ecosystem. This flaw allows attackers to forge SAML authentication responses, potentially granting unauthorized access to any user account in affected applications—including admin accounts—without any user interaction. If exploited, this vulnerability could enable full account takeovers across organizations relying on SAML-based single sign-on (SSO).
Windows Themes zero-day bug exposes users to NTLM credential theft (theregister.com)
There's a Windows Themes spoofing zero-day bug on the loose that allows attackers to steal people's NTLM credentials.