CVE-2026-12704

Name of the Vulnerable Software and Affected Versions Grafana Enterprise (affected versions not specified)

Description When the allow idp initiated SAML setting is enabled, the SAML library fails to validate the InResponseTo field on all SAML responses, including those from Service Provider (SP)-initiated logins. This failure removes anti-replay protection, which is a security mechanism that prevents a previously used authentication token from being used again. Consequently, an attacker who obtains a valid signed SAML assertion can replay it to gain an unauthorized session as the victim user.

Recommendations Disable the allow idp initiated SAML setting to restore validation of the InResponseTo field.