Relyra, a SAML 2.0 Service Provider library for Elixir and Phoenix, versions 1.0.0 and 1.1.0 improperly authenticate SAML assertions by accepting forged signatures. The verification process omitted cryptographic checks such as verifying the SignatureValue over the canonicalized SignedInfo with the IdP's public key and recomputing the DigestValue. The canonicalization function was unused in the verification path, resulting in acceptance based solely on document structure and trust-source rejection without validating the actual signature bytes. Consequently, an attacker could present a forged SignatureValue with a controlled NameID and receive a successful authentication response. This vulnerability is tracked as CVE-2026-49454 and was resolved in version 1.2.0.

Successful exploitation allows an attacker to bypass authentication by presenting forged SAML signatures, potentially impersonating any user. This compromises confidentiality and integrity of authentication, enabling unauthorized access without requiring privileges or user interaction. The vulnerability does not affect availability.

Upgrade to relyra version 1.2.0 or later, where proper cryptographic verification of SAML signatures is implemented. Patch status is confirmed by the vendor advisory stating the issue is fixed in 1.2.0. No other mitigations are indicated.