EEF-CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Summary Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode\idp\auth\resp/3 in lib/samly/helper.ex calls esaml\sp:validate\assertion/2, whose default duplicate...

CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...

EUVD-2026-63490

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decodeidpauthresp/3 in lib/samly/helper.ex calls esamlsp:validateassertion/2, whose default duplicate detector is ...

PT-2026-79072

Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later Description An authentication bypass exists where an attacker can authenticate as the subject of a captured SAML assertion by resubmitting it. This occurs because the function decode idp auth resp/3 in...

CVE-2026-72780 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey

Craft CMS before 5.10.5 fails to persist updated credential counters after WebAuthn assertion validation in the passkey login endpoint. Attackers can replay captured login request bodies containing requestOptions and response to create additional authenticated sessions for victim accounts...

EUVD-2026-53716

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

The CVE affects Keycloak’s SAML broker component when configured as an IdP-Initiated flow. The vulnerability arises because OneTimeUse in SAML assertions is not enforced, allowing an attacker who captures a valid, unused assertion to replay it and potentially hijack a user’s session, granting una...

CVE-2026-18967 Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-15615

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

CVE-2026-15615

Technical details about CVE-2026-15615 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2026-15615 SAML <Conditions> element not validated

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

EUVD-2026-48302

Logto omits validation of the SAML element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely...

PT-2026-64019

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto fails to validate the SAML element. This allows attackers to remove time and audience restrictions, which enables the indefinite replay of assertions. SAML Security Assertion Markup...

PT-2026-53861

Name of the Vulnerable Software and Affected Versions Rancher versions 2.14.0 through 2.14.2 Rancher versions 2.13.0 through 2.13.6 Rancher versions 2.12.0 through 2.12.10 Rancher versions 2.11.0 through 2.11.14 Description A SAML authentication replay issue exists in the Assertion Consumer Servi...

CVE-2026-41577

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor ResponseProcessor.parse does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expir...

authentik 数据伪造问题漏洞

Authentik is an open-source identity provisioning application developed by Authentik. Versions of Authentik before 2025.12.5 and 2026.2.3 had a data manipulation vulnerability. This vulnerability stemmed from the SAML response processor not verifying the Conditions element in assertions, which...

CVE-2026-9095 CVE-2026-9095

Casdoor versions 2.362.0 and earlier map SAML assertions to user sessions without replay protection. The ParseSamlResponse function in object/samlsp.go calls sp.RetrieveAssertionInfo and immediately maps the result to a user session. There is no assertion ID cache, OneTimeUse condition enforcemen...

PT-2026-44424

Name of the Vulnerable Software and Affected Versions Casdoor versions prior to 2.362.1 Description Casdoor maps SAML assertions to user sessions without replay protection. The ParseSamlResponse function in object/saml sp.go calls sp.RetrieveAssertionInfo and immediately maps the result to a user...

Casdoor 安全漏洞

Casdoor is an open-source platform developed by Casdoor that supports various authentication and authorization protocols. Versions of Casdoor prior to 2.362.0 contained security vulnerabilities. These vulnerabilities stemmed from a lack of replay protection when mapping SAML assertions to user...