CVE-2026-11753 · Package
NO FIX YET · SEE WHAT TO DO
armeria-saml copies the attacker-controlled RelayState parameter into the HTTP Location header after a successful SAML login. An attacker can therefore send a user to any URL they choose, which is an open redirect often used for phishing.
first public Oct 27, 2026 · 1 public exploit · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that use armeria-saml to handle SAML single sign-on and send users back to a URL taken from the RelayState parameter are exposed. Applications that do not use armeria-saml, or that do not use RelayState for redirects, can skip it.
Not affected if no-relaystate-redirect, not-using-armeria-saml
Who cares armeria-saml, java, saml, sso
build.gradle or pom.xml) and see whether it is below 1.41.1.1.41.1 are affected; move to 1.41.1 or later.A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL.
This page as .md · .json · in your agent: get_signal("CVE-2026-11753") · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.