CVE-2026-53424: Samly Authentication Bypass via Replay of SAML Bearer Assertions
Summary
CVE-2026-53424: Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions. Affects samly across 2 version ranges.
>= 0.3.0
>= 8a5bb1b4a4753d05470da2036323477f63cfdf4c
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samly is an open-source library used for handling SAML (Security Assertion Markup Language) assertions in web applications. It facilitates Single Sign-On (SSO) capabilities by allowing users to authenticate via SAML assertions. The library is designed to simplify the integration of SAML authentication into applications, but it has a critical vulnerability that affects its security posture.
Vulnerability Detail
The vulnerability arises from a missing enforcement of one-time-use for SAML bearer assertions in the Samly library. Specifically, the function Samly.Helper.decode_idp_auth_resp/3 calls esaml_sp:validate_assertion/2, which lacks a proper duplicate detection mechanism. As a result, an attacker can capture a valid SAMLResponse and replay it multiple times until the assertion's NotOnOrAfter condition is met, allowing unauthorized access as the original subject of the assertion. This vulnerability is classified as an Authentication Bypass by Capture-replay, which can lead to significant security breaches.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement your own duplicate detection mechanism by modifying the assertion validation logic. For example, you can store the IDs of processed assertions in a cache or database and check against this list before allowing further processing of the same assertion.
Conclusion
CVE-2026-53424 represents a significant security risk for applications using the Samly library due to its failure to enforce one-time-use for SAML assertions. It is crucial for developers to update their libraries and implement additional security measures to protect against potential exploitation.
See every vulnerability recorded for samly →
FAQ
CVE-2026-53424 is a vulnerability in the Samly library that allows attackers to replay SAML bearer assertions, leading to potential unauthorized access.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring sign-up.
The vulnerability can lead to unauthorized access to user accounts, session hijacking, and other security breaches, compromising the integrity of the application.
Yes, a patch is available. Update the Samly package to version 0.3.1 or later to mitigate the vulnerability.
The CVSS score for this vulnerability is 9.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for samly.
