CVE-2024-25718

Name of the Vulnerable Software and Affected Versions Samly package versions prior to 1.4.0 for Elixir

Description The issue arises from the Samly.State.Store.get assertion/3 function, which can return an expired session. This interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the Samly.State.Store.get assertion/3 function until a patch is available. Restrict access to the Samly.AuthHandler to minimize the risk of exploitation.