CVE-2026-49454: Relyra Authentication Bypass Due to Unverified SAML SignatureValue
Summary
CVE-2026-49454: Relyra SAML SignatureValue not cryptographically verified -> authentication bypass. Affects relyra versions >= 1.0.0, < 1.2.0. Fixed in 1.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Relyra is an open-source library designed for handling SAML (Security Assertion Markup Language) authentication in applications. It simplifies the process of integrating SAML-based single sign-on (SSO) by managing the complexities of SAML assertions and responses. However, versions 1.0.0 and 1.1.0 of Relyra have a critical vulnerability that allows attackers to bypass authentication by exploiting unverified SAML signatures.
Vulnerability Detail
The vulnerability arises from Relyra's failure to cryptographically verify the 'SignatureValue' in SAML responses. In versions 1.0.0 and 1.1.0, the XML Digital Signature (XMLDSig) trust boundary is incomplete, allowing forged signatures to be accepted as valid. The library does not perform necessary verification steps, such as checking the 'DigestValue' against the canonicalized referenced element or using the correct public key for signature verification. This flaw can lead to unauthorized access, as an attacker can craft a SAML response with a forged 'SignatureValue' and gain access as any user in applications relying on Relyra for authentication.
How To Fix
Minimum fixed version
1.2.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no safe configuration for versions 1.0.0 or 1.1.0. The only recommended action is to upgrade to version 1.2.0 or later. No workaround exists that can mitigate the risk in the affected versions.
Conclusion
The vulnerability identified as CVE-2026-49454 in Relyra poses a significant risk of authentication bypass due to unverified SAML signatures in versions 1.0.0 and 1.1.0. It is crucial for users of Relyra to upgrade to version 1.2.0 or later to mitigate this risk and ensure secure authentication processes.
See every vulnerability recorded for relyra →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Relyra versions 1.0.0 and 1.1.0 are affected by this vulnerability.
If you do not upgrade Relyra, your application remains vulnerable to authentication bypass, allowing attackers to log in as any user.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts in real-time for open-source vulnerabilities in your software using just the mix.lock file. It helps you stay informed about potential security issues.
