The vulnerability exists in samly's handling of SAML assertions. Specifically, the function Samly.Helper.decode_idp_auth_resp/3 calls esaml_sp:validate_assertion/2, which by default does not detect duplicate assertions. Although esaml provides a duplicate detection mechanism via a function with arity 3, samly does not use or allow configuration of this function. Consequently, the requirement that a SAML bearer assertion be used only once is not enforced. An attacker who obtains a valid SAMLResponse can replay it multiple times before the assertion's expiration (NotOnOrAfter), establishing sessions as the assertion's subject repeatedly. This affects samly version 0.3.0.

An attacker who captures a valid SAML assertion can bypass authentication controls by replaying the assertion multiple times, gaining unauthorized access as the assertion's subject. This undermines the security of SAML-based single sign-on in affected samly versions, potentially allowing session hijacking or unauthorized access without needing credentials or interaction from the legitimate user.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a fix is available, users should consider mitigating the risk by implementing external duplicate assertion detection or restricting replay windows where possible. Monitor vendor communications for updates and apply official patches once released.