Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses

Summary

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested. Samly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue. This issue affects samly: from 0.3.0 onward.

Timeline

1. Aug 20, 2026, 5:26 PM UTCCVE published
2. Aug 21, 2026, 7:50 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Aug 21, 2026, 7:50 PM UTCRecord last updated

Affected versions

• samly

  From 0.3.0

• dropbox/samly

  Version range not reported

• handnot2/samly

  Version range not reported

References 2