CVE-2026-49454: Relyra SAML SignatureValue not cryptographically verified -> authentication bypass

Synopsis

Authentication bypass in Relyra, a SAML 2.0 Service Provider library for Elixir and Phoenix (versions 1.0.0 and 1.1.0), allows a remote, unauthenticated attacker to forge a SAML assertion and authenticate as any user, including privileged ones. The library accepted SAML responses based on document structure alone without performing the required cryptographic signature verification steps, meaning an attacker could craft a forged SignatureValue with an arbitrary NameID and receive a successful authentication result. This is a network-reachable, zero-authentication exploit path that grants full identity impersonation. A patched-image rebuild at version 1.2.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SAML assertion consumer endpoint over the network; no local access or special positioning is required.

• AuthenticationNot required

  No credentials or existing session are needed; the attacker submits a forged SAML response as an unauthenticated party.

• Victim interactionNot required

  The attacker sends the forged SAML response directly to the service provider endpoint without requiring any action from a legitimate user.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable; no race conditions, memory layout knowledge, or environmental dependencies are required to forge a valid-looking SAML response.

Blast Radius

• Attacker authenticates to the application as any arbitrary user by supplying a forged NameID, including accounts with administrative privileges.
• All data and functionality accessible to the impersonated account becomes readable and modifiable by the attacker for the duration of the forged session.
• Existing session isolation and role-based access controls are bypassed entirely because the identity claim is accepted at the authentication layer before any authorization check runs.
• Data integrity of audit logs and attribution records is undermined because actions performed under the forged identity are attributed to the victim account.