dropbox samly vulnerabilities (CVE)

CVE records published for dropbox samly, newest first. Follow to get an email when a new one appears.

2 results

9.1Critical

CVE-2026-53424 2 months ago

Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions

dropbox samly; handnot2 samly

Authentication Bypass by Capture-replay vulnerability in dropbox samly allows an attacker to authenticate as the subject of a captured SAML assertion by resubmitting it. Samly.Helper.decode_idp_auth_resp/3 in lib/samly/helper.ex calls esaml_sp:validate_asser…

7.6High

CVE-2026-53425 2 months ago

Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

dropbox samly; handnot2 samly

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex …