GHSA-v86g-h7gx-q845: Security vulnerability

Published Nov 4, 2026

Updated

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.

Event History

Nov 4, 2026

CVE Published

via OSV·05:18 AM

Data Sourced

via OSV·05:18 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

Deployments using armeria-saml versions earlier than 1.41.1 are affected when they accept bearer assertions. The issue concerns assertion replay during the assertion's validity period.

What does an attacker need to exploit this issue?

An attacker needs a previously consumed bearer assertion ID that is still within its validity period. They can then replay that ID because one-time use is not enforced.

What version should be used to remediate the issue?

Upgrade armeria-saml to version 1.41.1 or later. Versions prior to 1.41.1 are identified as affected.

GHSA-v86g-h7gx-q845: Security vulnerability

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What version should be used to remediate the issue?