CVE-2026-53425
Received Received - Intake

Authentication Bypass via SAML InResponseTo in samly

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: EEF

Description
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-53425
EUVD
EUVD-2026-63489

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dropbox samly From 0.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Samly library allows an attacker to create an authenticated session without the service provider requesting it. The library fails to check if a SAML response matches a previously issued authentication request, violating the SAML 2.0 Core specification. Attackers exploit this by using a validly signed assertion from a trusted Identity Provider and matching the victim's session RelayState.

Detection Guidance

To detect this vulnerability, inspect SAML responses for missing InResponseTo validation. Check if your SAML library compares the InResponseTo attribute in responses against the AuthnRequest ID. Review logs for unsolicited SAML responses or mismatched RelayState values.

Impact Analysis

An attacker could impersonate a legitimate user by establishing an authenticated session without proper validation. This could lead to unauthorized access to sensitive data or system functions. Exploitation requires the attacker to obtain a valid signed assertion and craft a matching RelayState.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It undermines authentication integrity, a key control for regulatory compliance.

Mitigation Strategies

Upgrade to a patched version of samly if available. Implement additional validation in your SAML handler to verify InResponseTo matches AuthnRequest ID. Monitor SAML traffic for unsolicited responses and ensure RelayState values are validated against active sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart