The vulnerability in Dropbox samly (version 0.3.0) stems from the SPHandler.validate_authresp/3 function failing to validate the SubjectConfirmationData/@InResponseTo attribute in SAML responses. The function only compares RelayState, IdP identifier, and presence of a target URL but does not check that the InResponseTo matches the AuthnRequest ID issued by the service provider, which is never persisted. According to SAML 2.0 Core section 4.1.4.3, a service provider must reject responses whose InResponseTo does not correspond to a request it made. The underlying esaml library also does not inspect InResponseTo, leaving this verification gap open. An attacker with a valid signed assertion from the trusted IdP for their own account and a RelayState matching the victim's session can exploit this to establish an authenticated session without a legitimate request. This is a logic flaw in the SAML response validation process, not a cryptographic signature issue.

An attacker can establish an authenticated session with the service provider by replaying or injecting a valid SAML response that was never requested by the service provider. This can lead to unauthorized access to the victim's session or resources. The vulnerability requires the attacker to have a valid signed assertion from the trusted IdP for their own account and to match the victim's RelayState, but it bypasses the critical check that the response corresponds to an actual authentication request. This undermines the integrity of the SAML authentication flow and can result in session hijacking or unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users of samly version 0.3.0 should consider implementing additional validation to ensure the InResponseTo attribute in SAML responses matches the ID of the AuthnRequest issued by the service provider. Monitoring for suspicious SAML responses and restricting RelayState values may help reduce risk, but these are partial mitigations. Follow official vendor advisories for updates and patches.