CVE-2020-5261 Missing Token Replay Detection

What is CVE-2020-5261?

CVE-2020-5261 is a high-severity authentication bypass vulnerability in Sustainsys Saml2, published on 25 Mar 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

Weakness: CWE-294

Which versions are affected by CVE-2020-5261?

2 open source packages ship an affected version, including Sustainsys.Saml2. It affects 1 product.

Products include Sustainsys Saml2.

How do I fix CVE-2020-5261?

Upgrade Sustainsys.Saml2 to 2.5.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-5261 being exploited?

There is no known exploitation of CVE-2020-5261 in the wild and no public exploit code.

Other vulnerabilities in Sustainsys Saml2

• CVE-2023-41890 Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation High 7.5
• CVE-2020-5268 Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g6j2-ch25-5mmv.