---
id: "CVE-2026-11749"
kind: "vulnerability"
aliases: ["CVE-2026-11749"]
title: "armeria-saml: bearer assertions replayable within validity period"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["armeria", "authentication", "java", "package", "saml"]
not_affected_if: ["no-saml-login", "other-auth-library"]
published_at: "2026-11-04T06:17:03+00:00"
first_seen_at: "2026-11-04T06:25:19+00:00"
updated_at: "2026-11-04T06:25:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11749", "first_seen_at": "2026-11-04T06:25:19+00:00"}]
---

# armeria-saml: bearer assertions replayable within validity period

armeria-saml does not enforce one-time use of bearer SAML assertions, so an assertion ID that was already consumed can be submitted again while it is still valid. An attacker who captures an assertion can replay it to log in again.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the `armeria-saml` version in the project's dependency lock file or build output
- Check whether the service accepts SAML bearer assertions through `armeria-saml`

## Fix

- `armeria-saml` prior to `1.41.1`: move to `1.41.1` or later

## Timeline

- 2026-11-04T06:25:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-11749

## Documents

- [advisory] Vendor advisory: github.com https://github.com/line/armeria/security/advisories/GHSA-v86g-h7gx-q845
- [mentions] NVD record CVE-2026-117493 https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-117493

## From the sources

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_