Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-53424 – SAML Authentication Bypass via Assertion Replay – Samly (Elixir) v0.3.0 and later

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-53424 is an Authentication Bypass by Capture-replay vulnerability (CWE-294) in Samly, the Elixir library used to add SAML Service Provider authentication to Plug/Phoenix applications. The flaw allows an attacker in possession of a previously issued, valid SAML assertion (SAMLResponse) to replay it and repeatedly establish authenticated sessions as the assertion’s subject. The issue carries a CVSS v4.0 base score of 9.1 (Critical) and affects all published versions of Samly from v0.3.0 onward.

Technical details

  • Root cause: Samly.Helper.decode_idp_auth_resp/3 (in lib/samly/helper.ex) calls esaml_sp:validate_assertion/2 from the underlying esaml library. This arity uses a no-op duplicate/replay detector by default.
  • esaml does provide a validate_assertion/3 arity that accepts a DuplicateFun callback to enforce one-time use of bearer assertions, but Samly never invokes this arity and exposes no configuration option for applications to supply their own duplicate-detection logic.
  • As a result, the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be consumed only once is not enforced anywhere in the request path.
  • Trigger conditions: An attacker needs to obtain the raw bytes of a legitimate SAMLResponse — e.g., from network capture, browser history, proxy/server logs, or a referrer leak — for a session that has not yet passed its NotOnOrAfter expiry.
  • Attack vector: Network. The attacker resubmits the identical, unmodified SAMLResponse to the Samly SP endpoint; no user interaction or elevated privileges are required, though the attacker must be in possession of the captured assertion (attack requirements: present).
  • Impact: Each replay of the captured assertion re-establishes a valid authenticated session as the assertion’s subject, allowing full impersonation/account takeover of the affected user for as long as the assertion remains within its validity window. Confidentiality and integrity impact are both rated High; there is no direct availability impact.

Affected software

  • samly (Hex package): v0.3.0 and all later published versions
  • dropbox/samly (GitHub): commit 8a5bb1b4a4753d05470da2036323477f63cfdf4c and all later commits
  • handnot2/samly (GitHub fork): commit 8a5bb1b4a4753d05470da2036323477f63cfdf4c and all later commits

Severity

  • CVSS v4.0 Base Score: 9.1 (Critical)
  • Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  • A CVSS v3.1 vector has not been published for this CVE by the assigning CNA (ErlangEcosystem Foundation / EEF) as of publication; only the v4.0 score above is available in the official CVE record.

Mitigation and recommended actions

  • Immediate: As of publication, no patched Samly release addressing this issue has been identified in the official CVE record or vendor advisory. Security teams should monitor the Samly Hex package and the dropbox/samly and handnot2/samly GitHub repositories for a fixed release and upgrade as soon as one is available.
  • If no patch is available:
    • Shorten the NotOnOrAfter validity window issued by your Identity Provider for SAML assertions consumed by Samly, to minimize the time window in which a captured assertion can be replayed.
    • Ensure all traffic to the Samly SP endpoint is transported over TLS to reduce the risk of network capture of SAMLResponse values.
    • Audit and lock down access to logs, proxies, and browser history/referrer data that could contain raw SAMLResponse values, and avoid logging full SAML request/response bodies.
    • Where feasible, front the Samly SP endpoint with a custom validation layer that tracks consumed assertion IDs (e.g., the InResponseTo/assertion ID) and rejects duplicates, replicating the one-time-use enforcement that esaml‘s validate_assertion/3 DuplicateFun would otherwise provide.
    • Monitor authentication logs for multiple sessions being established from the same SAML assertion identifier or from anomalous source IPs/user agents in short succession.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge