7.6
HIGH
CVSS 4.0
CVE-2026-53425
Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
Overview
Description
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.
Details
INFO
Published Date :
Aug. 20, 2026, 6:16 p.m.
Last Modified :
Aug. 24, 2026, 4:47 p.m.
Remotely Exploit :
Yes !
Source :
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db | ||||
| CVSS 4.0 | HIGH | 6b3ad84c-e1a6-4bf7-a703-f496b71e49db |
Solution
Update samly to a version that validates the InResponseTo attribute in SAML responses.
- Update the samly library to a patched version.
- Ensure InResponseTo is validated against sent requests.
- Verify IdP identifiers and target URLs.
- Confirm session data integrity.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53425.
| URL | Resource |
|---|---|
| https://cna.erlef.org/cves/CVE-2026-53425.html | |
| https://osv.dev/vulnerability/EEF-CVE-2026-53425 |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53425 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53425
weaknesses.
CAPEC-111: JSON Hijacking (aka JavaScript Hijacking) JSON Hijacking (aka JavaScript Hijacking)
CAPEC-141: Cache Poisoning Cache Poisoning
CAPEC-142: DNS Cache Poisoning DNS Cache Poisoning
CAPEC-148: Content Spoofing Content Spoofing
CAPEC-218: Spoofing of UDDI/ebXML Messages Spoofing of UDDI/ebXML Messages
CAPEC-384: Application API Message Manipulation via Man-in-the-Middle Application API Message Manipulation via Man-in-the-Middle
CAPEC-385: Transaction or Event Tampering via Application API Manipulation Transaction or Event Tampering via Application API Manipulation
CAPEC-386: Application API Navigation Remapping Application API Navigation Remapping
CAPEC-387: Navigation Remapping To Propagate Malicious Content Navigation Remapping To Propagate Malicious Content
CAPEC-388: Application API Button Hijacking Application API Button Hijacking
CAPEC-665: Exploitation of Thunderbolt Protection Flaws Exploitation of Thunderbolt Protection Flaws
CAPEC-701: Browser in the Middle (BiTM) Browser in the Middle (BiTM)
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53425 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53425 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 21, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-53425', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-21T19:50:24.245049Z'} -
CVE Modified by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Aug. 20, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': 'v0.3.0', 'lessThan': '*', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/samly', 'packageName': 'samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/dropbox/samly', 'packageName': 'dropbox/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/handnot2/samly', 'vendor': 'handnot2', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/handnot2/samly', 'packageName': 'handnot2/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}] [{'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '0.3.0', 'lessThan': '*', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/samly', 'packageName': 'samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/dropbox/samly', 'packageName': 'dropbox/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/handnot2/samly', 'vendor': 'handnot2', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/handnot2/samly', 'packageName': 'handnot2/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}] Changed Description Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from v0.3.0 onward. Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward. -
New CVE Received by 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Aug. 20, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': 'v0.3.0', 'lessThan': '*', 'versionType': 'semver'}], 'packageURL': 'pkg:hex/samly', 'packageName': 'samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://repo.hex.pm', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/dropbox/samly', 'vendor': 'dropbox', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/dropbox/samly', 'packageName': 'dropbox/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {'cpes': ['cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*'], 'repo': 'https://github.com/handnot2/samly', 'vendor': 'handnot2', 'modules': ["'Elixir.Samly.SPHandler'"], 'product': 'samly', 'versions': [{'status': 'affected', 'version': '8a5bb1b4a4753d05470da2036323477f63cfdf4c', 'lessThan': '*', 'versionType': 'git'}], 'packageURL': 'pkg:github/handnot2/samly', 'packageName': 'handnot2/samly', 'programFiles': ['lib/samly/sp_handler.ex'], 'collectionURL': 'https://github.com', 'defaultStatus': 'unaffected', 'programRoutines': [{'name': "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}] Added Description Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from v0.3.0 onward. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-345 Added Reference https://cna.erlef.org/cves/CVE-2026-53425.html Added Reference https://osv.dev/vulnerability/EEF-CVE-2026-53425
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.