Sztheory

**Name of the Vulnerable Software and Affected Versions** Relyra versions 1.0.0 through 1.1.0 **Description** Relyra is a SAML 2.0 Service Provider library for Elixir and Phoenix that accepts forged SAML signatures. This occurs because the `SignatureValue` is not cryptographically verified before the library returns a successful authentication result. The XMLDSig trust boundary is incomplete because `:public key.verify` over the exclusive-C14N canonicalized `SignedInfo` is not performed against the configured IdP certificate's public key, the `DigestValue` is not recomputed over the canonicalized referenced element, and the `canonicalize/2` function remains an unused passthrough in the signature-verification path. Consequently, a structure-only acceptance path exists where document shape and trust-source rejection can succeed without proving the signature bytes, allowing a forged `SignatureValue` containing an attacker-controlled `NameID` to be accepted as `{:ok}`. **Recommendations** Update to version 1.2.0.