CVE-2026-53424
Received Received - Intake

Authentication Bypass via SAML Assertion Replay in Samly

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: EEF

Description
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject. This issue affects samly: from 0.3.0 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-53424
EUVD
EUVD-2026-63490

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
samly samly From 0.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authentication Bypass by Capture-replay in the samly library. It allows an attacker to bypass authentication by reusing a captured SAML assertion. The library fails to enforce the SAML 2.0 requirement that assertions be used only once, enabling repeated authentication as the assertion's subject.

Detection Guidance

To detect this vulnerability, monitor for repeated SAML authentication attempts using the same SAMLResponse token. Check logs for multiple successful authentications from the same SAML assertion within its validity period. Inspect network traffic for duplicate SAML responses being submitted.

Impact Analysis

An attacker could gain unauthorized access to your system by replaying a valid SAMLResponse. This could lead to session hijacking, data breaches, or impersonation of legitimate users. The impact is high as it affects authentication integrity.

Compliance Impact

This vulnerability undermines authentication security, which is critical for compliance with GDPR, HIPAA, and other regulations requiring strong access controls. It may lead to unauthorized data access, violating confidentiality and integrity requirements.

Mitigation Strategies

Upgrade samly to a version that includes the DuplicateFun configuration or applies the esaml_sp:validate_assertion/2 fix. If upgrading is not possible, implement network-level controls to block duplicate SAML responses or monitor for repeated authentication attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53424. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart