CVE-2026-11749 · Package
NO FIX YET · SEE WHAT TO DO
armeria-saml does not enforce one-time use of bearer SAML assertions, so an assertion ID that was already consumed can be submitted again while it is still valid. An attacker who captures an assertion can replay it to log in again.
first public Nov 3, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use armeria-saml to accept SAML bearer assertions for authentication are exposed, because assertion IDs are not checked for prior use within their validity window. Services that do not use armeria-saml or do not accept bearer assertions can skip it. Whether a given deployment is reachable depends on how it validates SAML sign-in, which the sources do not describe.
Not affected if no-saml-login, other-auth-library
Who cares armeria, authentication, java, saml
armeria-saml version in the project's dependency lock file or build outputarmeria-samlarmeria-saml prior to 1.41.1: move to 1.41.1 or laterA vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.
This page as .md · .json · in your agent: get_signal("CVE-2026-11749") · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.