~ / search / GHSA-h3rw-77w7-92gf

GHSA-h3rw-77w7-92gf

Samly access control vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-25718

Packages

EcosystemPackageAffectedFixed in
Hex Samly < 1.4.0 1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

In the Samly package before 1.4.0 for Elixir, `Samly.State.Store.get_assertion/3` can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

References

External links from the advisory. They lead to third-party sites.