Authentication bypass via unverified SAML signature in Relyra (CVE-2026-49454)

Relyra versions 1.0.0 and 1.1.0 fail to cryptographically verify the SAML SignatureValue before returning a successful authentication result. The XMLDSig trust boundary is incomplete: no public-key verification is performed against the configured IdP certificate, DigestValue is not recomputed, and the canonicalization function is unused in the signature-verification path. An unauthenticated attacker can submit a forged SAML response with an attacker-controlled NameID and gain access as an arbitrary user. Affected versions: - >= 1.0.0, < 1.2.0 We recommend updating to: 1.2.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7 Details: https://vuln.today/cve/CVE-2026-49454