Patch Ticker

Armeria armeria-saml accepts reused login assertions

Someone can get in by reusing a login proof already used in a login library.

Summary

armeria-saml does not enforce one-time use of bearer assertions, so previously consumed assertion IDs can be replayed within their validity period. Versions before 1.41.1 are affected.

What to do

Update armeria-saml to 1.41.1 or later.

Products and platforms

  • Armeria

CVE IDs

Times

First published

First seen