Handnot2
Monthly
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.
Authentication bypass via SAML assertion replay affects Samly, the Elixir/Plug SAML 2.0 Service Provider library from Dropbox, in all releases from v0.3.0 onward. Because Samly.Helper.decode_idp_auth_resp/3 invokes esaml's validate_assertion with a no-op duplicate detector and exposes no way to supply a real one, a bearer assertion is never enforced as single-use; an attacker who captures a single valid SAMLResponse can resubmit the identical bytes to repeatedly log in as that assertion's subject until its NotOnOrAfter expires. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Authentication bypass in the Elixir SAML library samly (v0.3.0+) allows an attacker holding a validly IdP-signed SAML assertion to establish an authenticated session on the service provider without the SP ever having issued the corresponding AuthnRequest. The root cause is that Samly.SPHandler.validate_authresp/3 never persists the AuthnRequest ID and therefore cannot compare it against the SubjectConfirmationData/@InResponseTo attribute in incoming responses, violating SAML 2.0 Core §4.1.4.3. No public exploit has been identified at time of analysis, but the attack is technically accessible to any party who holds a legitimately signed IdP assertion and can obtain a victim's RelayState value.
A SSRF vulnerability (CVSS 6.3) that allows an attacker. Remediation should follow standard vulnerability management procedures.