External risk intelligence

Samly Authentication Bypass via Replay of SAML Assertions

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-53424

Samly is a SAML service provider library used to facilitate single sign-on (SSO). SAML endpoints are public-facing by design in normal use to allow users to authenticate from any network location, making this vulnerability directly exposed to the internet.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Samly library allows an attacker to bypass authentication by replaying a captured SAML assertion, potentially granting unauthorized access to systems. The core issue lies in the library's failure to enforce a requirement that a SAML assertion be used only once.

Attackers can reuse old login tokens.
Critical for verifying single sign-on security.
Confirm if Samly is used to prevent unauthorized access.

Attack Path

How an attacker could exploit the issue

An attacker can impersonate a legitimate user by capturing a valid SAML assertion and resubmitting it. Since the system does not check for duplicate assertions, the same assertion can be used repeatedly to establish new sessions as the original user. This bypasses authentication controls and allows unauthorized access.

No authentication required to start.
Resubmit a captured SAML assertion.
Unauthorized access to user accounts.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to bypass authentication and gain unauthorized access to systems by replaying previously captured SAML assertions. This could happen when a SAML assertion, which is used to verify a user's identity for single sign-on, is intercepted and resent. The system could then incorrectly treat the repeated assertion as a valid authentication event, potentially granting the attacker the same access as the original user.

System access could be compromised.
Replay of captured SAML assertions.
Unauthorized session establishment.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in the samly library likely falls under the responsibility of the platform or application development teams who integrate SAML for single sign-on. The first practical step is to determine the scope of samly's use within your organization, assess which SAML integrations are exposed externally, and identify the specific applications or services relying on these integrations to prioritize remediation efforts.

Identify application and platform teams.
Confirm external SAML integration exposure.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Samly library?

Samly is a software library for the Elixir programming language designed to act as a SAML service provider. Developers integrate it into their web applications to enable single sign-on (SSO), allowing users to log in using credentials managed by a separate identity provider. It essentially handles the complex handshake and data validation required to trust that a user is who they claim to be when they arrive at your application.

How does CVE-2026-53424 create an authentication bypass?

This vulnerability is classified as CWE-294, Authentication Bypass by Capture-replay. It occurs because Samly fails to enforce a security rule that requires a SAML assertion—the token confirming a user's identity—to be used only once. Because the library does not verify if an assertion has already been processed, an attacker can reuse a previously captured, valid assertion to log into the application as that user multiple times until the token naturally expires.

What triggers this authentication bypass?

An attacker triggers this by resubmitting a valid SAML response they have intercepted. This capture can occur through logs, browser history, or network traffic monitoring. Importantly, simply having a valid user session does not trigger this; the attack specifically requires the reuse of the raw assertion data sent during the initial login process. If an assertion is used only once and then discarded by the system, this bypass cannot occur.

Why is this vulnerability highly relevant?

Halo Surface Signal notes that Samly is used for SAML service provider functions, which are inherently designed to be public-facing to support remote user authentication. Because these endpoints must be accessible from any network location for SSO to function, the ability to replay these assertions is a significant risk. If your application uses Samly to handle external-facing logins, it is exposed to this replay attack by default.

What are the first steps for addressing this?

Start by identifying all internal platforms and applications that rely on the Samly library for authentication. Once you have a list of affected services, prioritize those with internet-facing SAML integrations, as these are the most accessible to attackers. Since this is a library-level issue, consult with your development teams to confirm their use of Samly and plan for necessary software updates or vendor-coordinated fixes to enforce assertion uniqueness.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.