CVE-2026-53424
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject. This issue affects samly: from 0.3.0 onward.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
samly
- Vendor
- dropbox
- Product
- samly
- Platforms
- Unknown
- Default status
unaffected- Package
- samly
- Package collection
- https://repo.hex.pm
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 0.3.0 | affected | semver | * | Unavailable | None listed |
samly
- Vendor
- dropbox
- Product
- samly
- Platforms
- Unknown
- Default status
unaffected- Package
- dropbox/samly
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8a5bb1b4a4753d05470da2036323477f63cfdf4c | affected | git | * | Unavailable | None listed |
samly
- Vendor
- handnot2
- Product
- samly
- Platforms
- Unknown
- Default status
unaffected- Package
- handnot2/samly
- Package collection
- https://github.com
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 8a5bb1b4a4753d05470da2036323477f63cfdf4c | affected | git | * | Unavailable | None listed |