CVE-2026-49454

Name of the Vulnerable Software and Affected Versions Relyra versions 1.0.0 through 1.1.0

Description Relyra is a SAML 2.0 Service Provider library for Elixir and Phoenix that accepts forged SAML signatures. This occurs because the SignatureValue is not cryptographically verified before the library returns a successful authentication result. The XMLDSig trust boundary is incomplete because :public key.verify over the exclusive-C14N canonicalized SignedInfo is not performed against the configured IdP certificate's public key, the DigestValue is not recomputed over the canonicalized referenced element, and the canonicalize/2 function remains an unused passthrough in the signature-verification path. Consequently, a structure-only acceptance path exists where document shape and trust-source rejection can succeed without proving the signature bytes, allowing a forged SignatureValue containing an attacker-controlled NameID to be accepted as {:ok}.

Recommendations Update to version 1.2.0.