CVE-2026-11753: Medium severity vulnerability
A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
armeria-samlto a version that resolves this vulnerability.Fixed in 1.41.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using armeria-saml versions earlier than 1.41.1 are affected if they process attacker-controlled RelayState values during SAML authentication.
What does an attacker need to exploit it?
The attacker needs a way to supply a RelayState value and induce a user to complete successful authentication. The RelayState can then be reflected into the HTTP Location header as an attacker-controlled redirect destination.
Are default deployments affected?
The available information identifies affected versions prior to 1.41.1, but does not state whether a default configuration restricts or validates RelayState values.
What is the remediation?
Upgrade armeria-saml to version 1.41.1 or later. The provided information does not specify an alternative mitigation when upgrading is not immediately possible.