EEF-CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

Summary Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode\idp\auth\resp/3 in lib/samly/helper.ex calls esaml\sp:validate\assertion/2, whose default duplicate...