← Back to CVE Explorer

CVE-2026-53425

Full vulnerability record from the local CVENow database.

Description

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.

Severity
HIGH
CVSS score
7.6 (v4.0)
Vulnerability status
Awaiting Analysis
Source identifier
6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Published
2026-08-20 18:16:27.850000
Last modified
2026-10-26 10:10:00.140000
View original CVE JSON 
{
  "id": "CVE-2026-53425",
  "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
  "published": "2026-08-20T18:16:27.850",
  "lastModified": "2026-10-26T10:10:00.140",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\nSamly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de verificación insuficiente de la autenticidad de los datos en samly de dropbox permite a un atacante establecer una sesión autenticada utilizando una respuesta SAML que el proveedor de servicios nunca solicitó.\n\nSamly.SPHandler.validate_authresp/3 en lib/samly/sp_handler.ex valida una respuesta SAML para el flujo iniciado por el SP comparando solo el valor de RelayState, el identificador del IdP y la presencia de una URL de destino mantenida en la sesión. Nunca compara SubjectConfirmationData/@InResponseTo con el ID de la AuthnRequest que el proveedor de servicios emitió, y ese ID de solicitud nunca se persiste, por lo que no es posible ninguna comparación. La sección 4.1.4.3 del núcleo de SAML 2.0 requiere que un proveedor de servicios rechace una respuesta cuyo InResponseTo no coincida con una solicitud que realizó. La biblioteca esaml subyacente verifica el estado, la firma, el destinatario, la audiencia y la caducidad, pero de manera similar nunca inspecciona InResponseTo, por lo que nada más cierra la brecha. La explotación requiere una aserción válidamente firmada del IdP de confianza, que un atacante puede obtener para su propia cuenta, y un RelayState que coincida con la sesión de la víctima; la firma de la aserción en sí permanece intacta, por lo que esto no es un problema de falsificación de firma.\n\nEste problema afecta a samly: a partir de la versión 0.3.0."
    }
  ],
  "affected": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "affectedData": [
        {
          "vendor": "dropbox",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://repo.hex.pm",
          "packageName": "samly",
          "cpes": [
            "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.SPHandler'"
          ],
          "programFiles": [
            "lib/samly/sp_handler.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.SPHandler':consume_signin_response/1"
            }
          ],
          "repo": "https://github.com/dropbox/samly",
          "packageURL": "pkg:hex/samly",
          "versions": [
            {
              "version": "0.3.0",
              "lessThan": "*",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "dropbox",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "dropbox/samly",
          "cpes": [
            "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.SPHandler'"
          ],
          "programFiles": [
            "lib/samly/sp_handler.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.SPHandler':consume_signin_response/1"
            }
          ],
          "repo": "https://github.com/dropbox/samly",
          "packageURL": "pkg:github/dropbox/samly",
          "versions": [
            {
              "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "handnot2",
          "product": "samly",
          "defaultStatus": "unaffected",
          "collectionURL": "https://github.com",
          "packageName": "handnot2/samly",
          "cpes": [
            "cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "'Elixir.Samly.SPHandler'"
          ],
          "programFiles": [
            "lib/samly/sp_handler.ex"
          ],
          "programRoutines": [
            {
              "name": "'Elixir.Samly.SPHandler':consume_signin_response/1"
            }
          ],
          "repo": "https://github.com/handnot2/samly",
          "packageURL": "pkg:github/handnot2/samly",
          "versions": [
            {
              "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c",
              "lessThan": "*",
              "versionType": "git",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 7.6,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "userInteraction": "PASSIVE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-21T19:50:24.245049Z",
          "id": "CVE-2026-53425",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://cna.erlef.org/cves/CVE-2026-53425.html",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    },
    {
      "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53425",
      "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"
    }
  ]
}