CVE-2026-49454: Relyra SAML Service Provider library accepts forged signatures (authentication bypass)

Overview

CVE-2026-49454 affects Relyra, a SAML Service Provider library for Elixir and Phoenix applications. According to the GitHub security advisory, versions 1.0.0 and 1.1.0 returned a successful authentication result without actually proving the XML signature on incoming SAML messages. The signature value was never checked against the configured Identity Provider (IdP) certificate's public key, the digest of the referenced element was not recomputed, and the canonicalization step in the verification path was an unused passthrough. In practice, validation only confirmed that the document had the expected shape. The weakness is classified as CWE-287 (Improper Authentication).

Impact

An unauthenticated remote attacker could submit a SAML response with a forged signature and an attacker-controlled NameID, and the library could accept it as a valid login. For applications relying on Relyra for single sign-on, this amounts to an authentication bypass and potential impersonation of any user, including administrators. The CNA rates it 9.1 (Critical) under CVSS 3.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting high confidentiality and integrity impact with no privileges or user interaction required.

Affected products and versions

• Relyra 1.0.0 (affected)
• Relyra 1.1.0 (affected)
• Relyra 1.2.0 contains the fix

The record does not include structured affected-version ranges; the list above comes from the advisory description.

Exploitation status

The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no confirmed exploitation appears in the sources consulted. No EPSS score is available in the record. Because the flaw requires no special conditions, exploitation would be straightforward for anyone who can reach the SAML consumer endpoint, so it should be treated as urgent.

Remediation and mitigation

• Upgrade Relyra to version 1.2.0 or later in every application that depends on it, and redeploy.
• Review the security advisory and the fix commits (2e45689, 8910200).
• If immediate upgrade is impossible, consider temporarily disabling SAML login or placing the application behind an additional authentication layer.
• After patching, invalidate existing sessions established via SAML so that any sessions obtained with forged assertions are terminated.

Detection guidance

• Review authentication logs for SAML logins whose NameID does not correspond to a login event recorded at the IdP for the same time window.
• Look for unexpected logins to privileged accounts, or logins from unusual sources, during the period vulnerable versions were deployed.
• Inventory dependencies (for example, lock files) to find applications pinned to Relyra 1.0.0 or 1.1.0.

Limitations of the available information

The NVD record is in Deferred status and contains no structured affected or fixed version data; version details come from the CNA description. No EPSS or SSVC data is available. The record does not state whether vulnerable versions were widely deployed or whether any exploitation attempts were observed.

Frequently asked questions

Which Relyra versions are affected by CVE-2026-49454?

The advisory states that versions 1.0.0 and 1.1.0 are affected and that the issue is fixed in version 1.2.0.

What can an attacker do with this flaw?

An unauthenticated attacker could submit a SAML response with a forged signature and a chosen NameID that the library accepts, potentially logging in as any user.

Is CVE-2026-49454 being exploited in the wild?

It is not listed in CISA KEV and no confirmed exploitation appears in the sources consulted.

What should I do besides upgrading?

After upgrading to 1.2.0, invalidate existing SAML-based sessions and review authentication logs for logins that have no matching event at the IdP.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.