CVE-2026-53425

Name of the Vulnerable Software and Affected Versions dropbox samly versions 0.3.0 and later

Description An issue exists where the service provider fails to properly verify the authenticity of SAML responses. Specifically, the validate authresp/3 function in lib/samly/sp handler.ex does not compare the SubjectConfirmationData/@InResponseTo attribute against the ID of the AuthnRequest issued by the service provider. Because the request ID is not persisted, the system cannot verify if the response corresponds to a request it actually made, which violates SAML 2.0 Core requirements. An attacker with a validly signed assertion from a trusted Identity Provider (IdP) for their own account and a RelayState matching the victim's session can establish an authenticated session using a response the service provider never requested.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.