CVE-2026-53425: Samly SAML Response Validation Flaw Allows Unsolicited Authentication
Summary
CVE-2026-53425: Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses. Affects samly across 2 version ranges.
>= 0.3.0
>= 8a5bb1b4a4753d05470da2036323477f63cfdf4c
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Samly is an open-source library developed by Dropbox for handling SAML (Security Assertion Markup Language) authentication in applications. It facilitates the integration of identity providers (IdPs) with service providers (SPs) by managing SAML assertions and responses. The library is designed to streamline the authentication process, ensuring secure user sessions. However, a critical vulnerability has been identified that compromises its ability to validate SAML responses properly, potentially allowing unauthorized access to user sessions.
Vulnerability Detail
The vulnerability arises from a missing validation of the InResponseTo attribute in SAML responses processed by the Samly library. Specifically, the SPHandler.validate_authresp function only checks the RelayState, IdP identifier, and target URL, neglecting to compare the InResponseTo value against the AuthnRequest ID issued by the service provider. This oversight allows an attacker to exploit the system by sending unsolicited SAML responses, which can lead to unauthorized access if the attacker possesses a validly signed assertion from a trusted IdP. The lack of persistence for the request ID further exacerbates the issue, making it impossible to perform necessary comparisons. This vulnerability affects versions of Samly from 0.3.0 onward.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your application implements additional checks on SAML responses to validate the InResponseTo attribute manually. This can be done by storing the AuthnRequest ID and comparing it against incoming SAML responses. However, this is not a permanent fix and should be replaced with an update to the library as soon as possible.
Conclusion
The CVE-2026-53425 vulnerability in the Samly library poses a significant risk by allowing unsolicited SAML responses to be accepted, potentially leading to unauthorized access. Users are strongly advised to update to the latest version of the library to mitigate this risk. Temporary workarounds can be implemented, but they should not replace a proper update.
See every vulnerability recorded for samly →
FAQ
CVE-2026-53425 is a vulnerability in the Samly library that allows attackers to exploit unsolicited SAML responses due to missing InResponseTo validation.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your application without requiring signup.
The primary risk is unauthorized access to user sessions, which can lead to data breaches and compromised user accounts.
Yes, a patched version of the Samly library is available. Users should update to the latest version to mitigate the vulnerability.
If an immediate update is not possible, implement additional validation checks for SAML responses as a temporary workaround until the library can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for samly.
