CVE-2026-11749: High severity vulnerability
Published Nov 4, 2026
·Updated
A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.
Event History
Nov 4, 2026
CVE Published
via MITRE·05:18 AM
Data Sourced
via MITRE·05:18 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
DescriptionSeverity
Frequently Asked Questions
1
Which deployments are exposed to assertion replay?
Deployments using armeria-saml versions earlier than 1.41.1 are affected when they accept bearer assertions. Previously consumed assertion IDs can be replayed while the assertion remains valid.
2
What does an attacker need to exploit this issue?
An attacker needs a previously consumed bearer assertion ID and must replay it within that assertion's validity period. The supplied data does not identify any authentication or privilege prerequisite.
3
What version resolves the issue?
The vulnerability affects versions prior to 1.41.1. Upgrading to 1.41.1 or later removes the affected version range described in the advisory.