CVE-2026-53424: CWE-294 Authentication Bypass by Capture-replay in dropbox samly
Description
CVE-2026-53424 is a critical authentication bypass vulnerability in Dropbox's samly library affecting versions 0.3.0 and later. The flaw allows an attacker to reuse a captured SAML assertion multiple times due to lack of enforcement of the single-use requirement for bearer assertions. This enables an attacker to authenticate as the subject of the captured assertion repeatedly until the assertion expires.
CVSS v4.0
Score 9.1critical
Affected software
dropbox
samly
dropbox
samly
handnot2
samly
cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because samly's decode_idp_auth_resp/3 function calls esaml_sp:validate_assertion/2, which uses a no-op duplicate detector by default. Although esaml provides a duplicate detection function in its /3 arity, samly does not call this nor allows configuration to supply one. Consequently, the SAML 2.0 Web Browser SSO Profile requirement that a bearer assertion be used only once is not enforced. An attacker who obtains a valid SAMLResponse can replay it multiple times to establish sessions as the assertion's subject until the assertion's NotOnOrAfter timestamp passes.
Potential Impact
An attacker with access to a valid SAMLResponse can bypass authentication controls by replaying the assertion multiple times, effectively impersonating the assertion's subject without needing credentials. This compromises authentication integrity and allows unauthorized access to protected resources.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should monitor the vendor advisory for updates. Until a fix is released, consider implementing external controls to detect and prevent replay attacks on SAML assertions or avoid using affected versions if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- EEF
- Date Reserved
- 2026-06-09T11:01:47.529Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a873eeeacd9273b49f2b5dc
Added to database: 08/20/2026, 17:52:46 UTC
Last enriched: 09/10/2026, 23:17:20 UTC
Last updated: 10/05/2026, 06:48:17 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.