CVE-2026-49454

{
  "id": "CVE-2026-49454",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-18T21:16:29.920",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because SignatureValue was not cryptographically verified before the library returned a successful authentication result. The XMLDSig trust boundary was incomplete as :public_key.verify over the exclusive-C14N canonicalized SignedInfo was not performed against the configured IdP certificate's public key, DigestValue was not recomputed over the canonicalized referenced element, and canonicalize/2 remained an unused passthrough in the signature-verification path. The result was a structure-only acceptance path where document shape and trust-source rejection could succeed without proving the signature bytes. A forged SignatureValue carrying an attacker-controlled NameID could be accepted as {:ok}. This issue has been fixed in version 1.2.0."
    },
    {
      "lang": "es",
      "value": "Relyra es una biblioteca de proveedor de servicios SAML 2.0 estricta por defecto para Elixir y Phoenix. Las versiones 1.0.0 y 1.1.0 aceptan firmas SAML falsificadas porque SignatureValue no fue verificado criptográficamente antes de que la biblioteca devolviera un resultado de autenticación exitoso. El límite de confianza de XMLDSig estaba incompleto ya que :public_key.verify sobre el SignedInfo canonizado exclusive-C14N no se realizó contra la clave pública del certificado IdP configurado, DigestValue no se volvió a calcular sobre el elemento referenciado canonizado, y canonicalize/2 permaneció como un passthrough sin usar en la ruta de verificación de firma. El resultado fue una ruta de aceptación solo por estructura donde la forma del documento y el rechazo de la fuente de confianza podían tener éxito sin probar los bytes de la firma. Un SignatureValue falsificado que contenía un NameID controlado por el atacante podía ser aceptado como {:ok}. Este problema ha sido solucionado en la versión 1.2.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "szTheory",
          "product": "relyra",
          "versions": [
            {
              "version": ">= 1.0.0, < 1.2.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T15:50:42.585285Z",
          "id": "CVE-2026-49454",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/szTheory/relyra/commit/8910200",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7",
      "source": "[email protected]"
    }
  ]
}