CVE-2026-53424 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions
Attackers can replay captured SAML assertions to authenticate as other users due to missing one-time-use enforcement in the Samly library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53424?
CVE-2026-53424 is a critical authentication bypass vulnerability in dropbox samly, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.
Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.
This issue affects samly: from 0.3.0 onward.
Weakness: CWE-294
Which versions are affected by CVE-2026-53424?
1 open source package ship an affected version, including samly.
| Package | Affected | Fixed in |
|---|---|---|
samly Hex | From 0.3.0 | None |
How do I fix CVE-2026-53424?
No fix has been published for CVE-2026-53424 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-53424 being exploited?
There is no known exploitation of CVE-2026-53424 in the wild and no public exploit code.
Sources
Also known as EEF-CVE-2026-53424, GHSA-5x87-gf34-8ww7.