{"apiVersion":"1.0","identifier":"CVE-2026-53425","description":"Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim-s session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.","publishedAt":"2026-08-20T18:16:27","lastModifiedAt":"2026-08-24T16:47:56","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-53425","cvssScore":7.6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","epssProbability":0.00178,"riskScore":0.77,"affectedProduct":"samly","affectedVersions":">=0.3.0","vulnerabilityType":"Library","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-53425","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-53425","en":"https://www.redsauce.net/en/cves/CVE-2026-53425","fr":"https://www.redsauce.net/fr/cves/CVE-2026-53425","pt":"https://www.redsauce.net/pt/cves/CVE-2026-53425","de":"https://www.redsauce.net/de/cves/CVE-2026-53425","sk":"https://www.redsauce.net/sk/cves/CVE-2026-53425","el":"https://www.redsauce.net/el/cves/CVE-2026-53425"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-53425"}}