CVE-2026-53424

{
  "id": "CVE-2026-53424",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-08-20T18:16:27.680",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it.\n\nSamly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_assertion/2, whose default duplicate detector is a no-op. The /3 arity accepting a DuplicateFun exists in esaml and implements the check, but Samly never calls it and offers no configuration to supply one, so the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used once is unenforced. An attacker holding a valid SAMLResponse obtained from the network, from browser history, or from logs can submit the identical bytes repeatedly until the assertion's NotOnOrAfter passes, each time establishing a session as the assertion's subject.\n\nThis issue affects samly: from 0.3.0 onward."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisión de autenticación por captura-repetición en dropbox samly permite a un atacante autenticarse como el sujeto de una aserción SAML capturada volviéndola a enviar.\n\nSamly.Helper.decode_idp_auth_resp/3 en lib/samly/helper.ex llama a esaml_sp:validate_assertion/2, cuyo detector de duplicados predeterminado es una operación nula (no-op). La aridad /3 que acepta una DuplicateFun existe en esaml e implementa la verificación, pero Samly nunca la llama y no ofrece ninguna configuración para proporcionarla, por lo que el requisito del perfil SSO de navegador web SAML 2.0 de que una aserción de portador se use una sola vez no se aplica. Un atacante que posee una SAMLResponse válida obtenida de la red, del historial del navegador o de los registros puede enviar los bytes idénticos repetidamente hasta que pase el NotOnOrAfter de la aserción, estableciendo cada vez una sesión como el sujeto de la aserción.\n\nEste problema afecta a samly: a partir de la versión 0.3.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "dropbox",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "samly",
          "cpes": [
            "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.Helper'"
          ],
          "programFiles": [
            "lib/samly/helper.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.Helper':decode_idp_auth_resp/3"
            }
          ],
          "repo": "https://github.com/dropbox/samly",
          "packageURL": "pkg:hex/samly",
          "versions": [
            {
              "version": "0.3.0",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "dropbox",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "dropbox/samly",
          "cpes": [
            "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.Helper'"
          ],
          "programFiles": [
            "lib/samly/helper.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.Helper':decode_idp_auth_resp/3"
            }
          ],
          "repo": "https://github.com/dropbox/samly",
          "packageURL": "pkg:github/dropbox/samly",
          "versions": [
            {
              "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "handnot2",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "handnot2/samly",
          "cpes": [
            "cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.Helper'"
          ],
          "programFiles": [
            "lib/samly/helper.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.Helper':decode_idp_auth_resp/3"
            }
          ],
          "repo": "https://github.com/handnot2/samly",
          "packageURL": "pkg:github/handnot2/samly",
          "versions": [
            {
              "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T19:41:30.269903Z",
          "id": "CVE-2026-53424",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-53424.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53424",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}