{"id":"CVE-2026-53424","aliases":["EEF-CVE-2026-53424","EUVD-2026-63490","GHSA-5x87-gf34-8ww7"],"status":"published","title":"Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions","description":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward.","severity":{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00602,"percentile":0.49268,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-294"],"published":"2026-08-20T17:27:11Z","modified":"2026-10-26T10:10:00Z","affected":[{"source":"osv","ecosystem":"Hex","package":"samly","ranges":[{"type":"SEMVER","events":[{"introduced":"0.3.0"}]}],"versions":["0.10.0","0.10.1","0.4.0","0.5.0","0.6.0","0.6.1","0.6.2","0.6.3","0.7.0","0.7.1","0.7.2","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.9.0","0.9.1","0.9.2","0.9.3","1.0.0","1.0.0-rc.0","1.0.0-rc.1","1.1.0","1.2.0","1.3.0","1.4.0"]}],"products":[{"vendor":"dropbox","product":"samly"},{"vendor":"handnot2","product":"samly"}],"references":[{"url":"https://cna.erlef.org/cves/CVE-2026-53424.html","tags":["related","third-party-advisory","web"]},{"url":"https://osv.dev/vulnerability/EEF-CVE-2026-53424","tags":["related"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53424"},{"url":"https://github.com/advisories/GHSA-5x87-gf34-8ww7"},{"url":"https://hex.pm/packages/samly","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53424","title":"Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions","description":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward.","status":"published","published":"2026-08-20T17:27:11.115Z","modified":"2026-08-21T19:42:21.623Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:20:00.11477Z"}],"euvd":[{"id":"EUVD-2026-63490","description":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward.","status":"published","published":"2026-08-20T17:27:11Z","modified":"2026-08-21T19:42:21Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:01:36.844009Z"}],"ghsa":[{"id":"GHSA-5x87-gf34-8ww7","title":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to...","description":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from v0.3.0 onward.","status":"published","published":"2026-08-20T18:30:59Z","modified":"2026-08-20T18:31:07Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:10:47.706589Z"}],"nvd":[{"id":"CVE-2026-53424","description":"Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward.","status":"published","published":"2026-08-20T18:16:27.68Z","modified":"2026-10-26T10:10:00.14Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"EEF-CVE-2026-53424","title":"Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions","description":"## Summary\n\nAuthentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\n`Samly.Helper.decode_idp_auth_resp/3` in `lib/samly/helper.ex` calls `esaml_sp:validate_assertion/2`, whose default duplicate detector is a no-op. The `/3` arity accepting a `DuplicateFun` exists in `esaml` and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid `SAMLResponse` obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's `NotOnOrAfter` passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward.","status":"published","published":"2026-08-20T17:27:11.115Z","modified":"2026-09-08T05:30:36.653017365Z","cvss":[{"version":"4.0","score":9.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-294"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}