Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53425— Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Quick assessment

Affected
dropbox samly
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

漏洞描述：数据真实性验证不足 Dropbox 中使用的 Samly 组件存在“数据真实性验证不足”漏洞，攻击者可以利用服务提供方（Service Provider, SP）从未请求过的 SAML 响应，建立已认证的会话。 在 Samly 中， 函数（位于 ）在服务提供方发起的流程中验证 SAML 响应时，仅比对了 值、身份提供方（IdP）标识符以及会话中保存的目标 URL。该函数从未将 与 SP 发出的 的 ID 进行比较，而且该请求 ID 也从未被持久化存储，因此根本不可能进行比对。 根据 SAML 2.0 规范

CVSS 7.6 · High EPSS 0.18% · P8

Affected Version Matrix 3

VendorProduct Version RangeStatus
dropbox samly 0.3.0< * affected
8a5bb1b4a4753d05470da2036323477f63cfdf4c< * affected
handnot2 samly 8a5bb1b4a4753d05470da2036323477f63cfdf4c< * affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53425

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
dropbox samly 0.3.0 ~ * cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*
dropbox samly 8a5bb1b4a4753d05470da2036323477f63cfdf4c ~ * cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*
handnot2 samly 8a5bb1b4a4753d05470da2036323477f63cfdf4c ~ * cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-53425

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53425

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-53425 (1)

IV. Related Vulnerabilities

Same product: samly
Same vendor: dropbox
Same weakness: CWE-345

V. Comments for CVE-2026-53425

No comments yet

Leave a comment