Relyra
Monthly
Authentication bypass in the Relyra SAML 2.0 Service Provider library for Elixir/Phoenix (versions 1.0.0 and 1.1.0) allows attackers to forge SAML assertions and log in as any user, because the library returned a successful authentication result without ever cryptographically verifying the XMLDSig SignatureValue. A forged SignatureValue carrying an attacker-controlled NameID is accepted as {:ok}, enabling full identity impersonation against any relying-party application. No public exploit identified at time of analysis, and EPSS is low (0.14%), but the flaw is trivially exploitable and marked automatable with total technical impact by CISA's SSVC framework.
Authentication bypass in the Relyra SAML 2.0 Service Provider library for Elixir/Phoenix (versions 1.0.0 and 1.1.0) allows attackers to forge SAML assertions and log in as any user, because the library returned a successful authentication result without ever cryptographically verifying the XMLDSig SignatureValue. A forged SignatureValue carrying an attacker-controlled NameID is accepted as {:ok}, enabling full identity impersonation against any relying-party application. No public exploit identified at time of analysis, and EPSS is low (0.14%), but the flaw is trivially exploitable and marked automatable with total technical impact by CISA's SSVC framework.