CVE-2026-53425: CWE-345 Insufficient Verification of Data Authenticity in dropbox samly

The samly.SPHandler.validate_authresp/3 function in Dropbox's samly library validates SAML responses for SP-initiated flows by checking RelayState, IdP identifier, and target URL presence but does not verify the SubjectConfirmationData/@InResponseTo attribute against the original AuthnRequest ID. The request ID is not persisted, so no comparison is possible. According to SAML 2.0 Core section 4.1.4.3, a service provider must reject responses whose InResponseTo does not match a request it made. The underlying esaml library also does not inspect InResponseTo, leaving a verification gap. Exploitation requires a valid signed assertion from the trusted IdP for the attacker's account and a RelayState matching the victim's session. The signature remains valid, so this is not a signature forgery issue. The vulnerability affects samly versions from 0.3.0 onward.

An attacker who can obtain a valid signed assertion from the trusted IdP for their own account and craft a RelayState matching a victim's session can establish an authenticated session as the victim without the service provider having requested the SAML response. This could lead to unauthorized access to the victim's session or resources. The vulnerability does not involve signature forgery but exploits insufficient verification of the InResponseTo attribute in SAML responses.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users of samly should be aware of this verification gap and consider additional controls or mitigations at the application or identity provider level to detect or prevent misuse of SAML responses with mismatched InResponseTo attributes.