EUVD-2026-63489
GHSA-4mhx-38g6-r4wq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because attacker needs a valid IdP-signed assertion plus victim's RelayState; UI:R because victim's active session state is a prerequisite; S:C because exploiting the SAML auth component crosses into the broader application session.
Primary rating from Vendor (EEF).
CVSS VectorVendor: EEF
Lifecycle Timeline
2DescriptionCVE.org
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.
Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.
This issue affects samly: from v0.3.0 onward.
AnalysisAI
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must be satisfied: (1) the attacker must hold a valid account at the IdP trusted by the target samly SP, enabling them to obtain a legitimately IdP-signed SAML assertion - assertion signature forgery is not involved and forged assertions are rejected by esaml; (2) the attacker must know or derive a RelayState value that matches an active or recent session entry in the SP's session store, which depends on RelayState predictability or the ability to observe the victim's browser traffic; (3) the target application must be running samly v0.3.0 or later and have SP-initiated SAML SSO enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.6 (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N) correctly reflects high confidentiality and integrity impact tempered by real prerequisites captured in AT:P and UI:P. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The definitive fix requires samly to persist the AuthnRequest ID at the time the SP-initiated flow begins and compare it against the InResponseTo attribute of the incoming SAML response, rejecting any response where no match is found - as mandated by SAML 2.0 Core §4.1.4.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: conduct inventory of systems using Samly library and assess authentication risk exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():sr
Dropbox.exe (and QtWebEngineProcess.exe in the Web Helper) in the Dropbox desktop application 71.4.108.0 store cleartext
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which int
A vulnerability was found in Dropbox merou. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
The allocate_channel_framebuffer function in uncompressed_components.hh in Dropbox Lepton 1.2.1 allows remote attackers
An issue was discovered in Dropbox Lepton 1.2.1. Rated medium severity (CVSS 5.5), this vulnerability is no authenticati
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dr
Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability. Rated high severity (CVSS 8.8), this vulnerability
Dropbox SDK for Android before 1.6.2 might allow remote attackers to obtain sensitive information via crafted malware or
An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. Rated medium severity (CVSS 6.4), this vulnerab
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management pro
Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensur
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today