{"id":"CVE-2026-11749","kind":"vulnerability","aliases":["CVE-2026-11749"],"related":[],"title":"armeria-saml: bearer assertions replayable within validity period","description":"A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.","summary":"armeria-saml does not enforce one-time use of bearer SAML assertions, so an assertion ID that was already consumed can be submitted again while it is still valid. An attacker who captures an assertion can replay it to log in again.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria","authentication","java","package","saml"],"not_affected_if":["no-saml-login","other-auth-library"],"how_to_check":"- Find the `armeria-saml` version in the project's dependency lock file or build output\n- Check whether the service accepts SAML bearer assertions through `armeria-saml`","fix":"- `armeria-saml` prior to `1.41.1`: move to `1.41.1` or later","status":"open","published_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","triaged_at":"2026-11-04T06:25:57+00:00","updated_at":"2026-11-04T06:25:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:25:57Z","model":"claude-haiku-5-5","output":{"fix":"- `armeria-saml` prior to `1.41.1`: move to `1.41.1` or later","reach":"network","title":"armeria-saml: bearer assertions replayable within validity period","impact":"high","summary":"armeria-saml does not enforce one-time use of bearer SAML assertions, so an assertion ID that was already consumed can be submitted again while it is still valid. An attacker who captures an assertion can replay it to log in again.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","armeria","saml","authentication"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker replays captured login assertion to gain access","analyst_note":"Confirm the affected SAML bearer-assertion flow and whether replay needs a captured assertion; check the vendor advisory on github.com for details.","how_to_check":"- Find the `armeria-saml` version in the project's dependency lock file or build output\n- Check whether the service accepts SAML bearer assertions through `armeria-saml`","plain_action":"","needs_analyst":true,"not_affected_if":["no-saml-login","other-auth-library"],"who_is_affected":"Applications that use armeria-saml to accept SAML bearer assertions for authentication are exposed, because assertion IDs are not checked for prior use within their validity window. Services that do not use armeria-saml or do not accept bearer assertions can skip it. Whether a given deployment is reachable depends on how it validates SAML sign-in, which the sources do not describe.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000697,"input_tokens":4131,"output_tokens":567,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-11749':12A,15A '-2026':11A,14A '1.41.1':74C 'allow':86C 'alreadi':41B 'armeria':2A,16B,22B,70C 'armeria-saml':1A,21B,69C 'assert':5A,34B,37B,57B,77C,91C 'attack':53B 'authent':17B 'bearer':4A,32B,76C 'captur':55B 'consum':42B,90C 'cve':10A,13A 'enforc':26B,80C 'id':38B,92C 'identifi':67C 'java':18B 'log':62B 'one':28B,83C 'one-tim':27B,82C 'packag':19B 'period':9A,96C 'previous':89C 'prior':72C 'replay':6A,59B,87C 'saml':3A,20B,23B,33B,71C 'still':50B 'submit':45B 'time':29B,84C 'use':30B,85C 'valid':8A,51B,95C 'vulner':64C 'within':7A,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that use armeria-saml to accept SAML bearer assertions for authentication are exposed, because assertion IDs are not checked for prior use within their validity window. Services that do not use armeria-saml or do not accept bearer assertions can skip it. Whether a given deployment is reachable depends on how it validates SAML sign-in, which the sources do not describe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeria","authentication","high","java","package","saml"],"campaign_type":null,"first_public_at":"2026-11-03T11:40:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11749","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11749","severity":null,"published_at":"2026-11-04T06:17:03+00:00","modified_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:19+00:00","fetched_at":"2026-11-04T06:25:19+00:00","note":null}],"documents":[{"id":5998,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-117493","title":"NVD record CVE-2026-117493","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":64638,"url":"https://github.com/line/armeria/security/advisories/GHSA-v86g-h7gx-q845","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T11:40:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}