CVE Alert: CVE-2025-46404 – Entr’ouvert – Lasso

**Risk verdict** High risk of remote denial of service against Entr'ouvert Lasso 2.5.1 via crafted SAML responses; no user interaction required.

**Why this matters** The impact is service availability rather than data breach, which can disrupt authentication flows and degrade access for users and partners. In environments reliant on SAML-based SSO, a DoS condition can cascade to broader business disruption, especially during peak login windows or peak partner activity.

**Most likely attack path** An external attacker targets a publicly exposed SAML endpoint. With network access and no privileges or user interaction, they can trigger a NULL pointer dereference in the SAML processing code, potentially crashing the service and causing DoS. The CVSS metrics support a network-based, low-competition path with high availability impact and no requirement for authentication.

**Who is most exposed** Organisations running on-premises or cloud-hosted Lasso deployments where the SAML endpoint is reachable by external networks or partner IdPs; typical in enterprises using Lasso as an SSO broker or IdP/SP integration.

Detection ideas

• Sudden service crashes or elevated memory/CPU on the Lasso host
• Error logs showing NULL pointer dereference in SAML verification
• spikes in SAML endpoint requests without corresponding logins
• Crash dumps or stack traces tied to lasso_provider_verify_saml_signature
• Unexplained login service unavailability during sustained SAML activity

Mitigation and prioritisation

• Apply vendor patch/upgrade to fixed version; verify compatibility in staging before production.
• Implement WAF rules to validate SAML responses and rate-limit the SAML endpoint; restrict exposure to trusted IdPs.
• Review change-management windows and notify stakeholders; plan a controlled upgrade.
• Consider temporary disabling or sandboxing of SAML verification if feasible until patch is deployed.
• If KEV or EPSS data indicate exploitation likelihood (not present here), treat as priority 1.