CVE-2025-47949 is a critical authentication bypass vulnerability in the widely adopted Samlify Node.js library, used to integrate SAML-based Single Sign-On (SSO) and Single Log-Out (SLO) in applications. Affecting all versions prior to v2.10.0, this Signature Wrapping flaw (CVSS score: 9.9/10) allows attackers to inject unsigned malicious assertions into legitimately signed SAML responses. Despite correctly verifying the digital signature on SAML responses, vulnerable versions of Samlify mistakenly process unsigned assertions from unprotected parts of the XML structure, enabling full SSO bypass and privilege escalation without user interaction or elevated access. This can lead to unauthorized access to user accounts, including administrative ones, and compromise of sensitive resources across systems integrated with identity providers like Azure AD or Okta. While no active exploitation has been reported, the vulnerability is easily exploitable with access to a valid signed XML blob. Organizations relying on Samlify (currently downloaded over 200,000 times weekly) are strongly urged to upgrade to v2.10.0, which contains the necessary patch but is only available via npm at the time of writing. CTIX analysts urge any affected readers to follow the advisory guidance and patch their instances immediately to prevent the threat of exploitation.