{"id":"CVE-2026-11753","kind":"vulnerability","aliases":["CVE-2026-11753"],"related":[],"title":"armeria-saml: unvalidated RelayState redirect after SAML login","description":"A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL.","summary":"armeria-saml copies the attacker-controlled RelayState parameter into the HTTP Location header after a successful SAML login. An attacker can therefore send a user to any URL they choose, which is an open redirect often used for phishing.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["armeria-saml","java","package","saml","sso"],"not_affected_if":["no-relaystate-redirect","not-using-armeria-saml"],"how_to_check":"- Check the armeria-saml version in the project's dependency file (for example `build.gradle` or `pom.xml`) and see whether it is below `1.41.1`.\n- Search the code that handles the SAML response for uses of RelayState that feed a redirect without an allow-list check.","fix":"- armeria-saml versions prior to `1.41.1` are affected; move to `1.41.1` or later.","status":"open","published_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","triaged_at":"2026-11-04T06:26:02+00:00","updated_at":"2026-11-04T06:26:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T06:26:02Z","model":"claude-haiku-5-5","output":{"fix":"- armeria-saml versions prior to `1.41.1` are affected; move to `1.41.1` or later.","reach":"internet","title":"armeria-saml: unvalidated RelayState redirect after SAML login","impact":"low","summary":"armeria-saml copies the attacker-controlled RelayState parameter into the HTTP Location header after a successful SAML login. An attacker can therefore send a user to any URL they choose, which is an open redirect often used for phishing.","audience":"developers","category":"package","nicknames":[],"who_cares":["armeria-saml","java","saml","sso"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"users are redirected to attacker-chosen sites for phishing","analyst_note":"","how_to_check":"- Check the armeria-saml version in the project's dependency file (for example `build.gradle` or `pom.xml`) and see whether it is below `1.41.1`.\n- Search the code that handles the SAML response for uses of RelayState that feed a redirect without an allow-list check.","plain_action":"","needs_analyst":false,"not_affected_if":["not-using-armeria-saml","no-relaystate-redirect"],"who_is_affected":"Applications that use armeria-saml to handle SAML single sign-on and send users back to a URL taken from the RelayState parameter are exposed. Applications that do not use armeria-saml, or that do not use RelayState for redirects, can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000685,"input_tokens":4153,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11753':12A,15A '-2026':11A,14A '1.41.1':76C 'allow':92C 'armeria':2A,17B,24B,71C 'armeria-saml':1A,16B,23B,70C 'attack':29B,44B,79C,99C 'attacker-control':28B,78C,98C 'authent':91C 'choos':54B 'control':30B,80C,100C 'copi':26B 'cve':10A,13A 'header':37B,88C 'http':35B,86C 'identifi':68C 'java':19B 'locat':36B,87C 'login':9A,42B 'often':60B 'open':58B 'packag':20B 'paramet':32B 'phish':63B 'prior':74C 'redirect':6A,59B,95C 'reflect':83C 'relayst':5A,31B,81C 'saml':3A,8A,18B,21B,25B,41B,72C 'send':47B 'sso':22B 'success':40B,90C 'therefor':46B 'unvalid':4A,94C 'url':52B,101C 'use':61B 'user':49B 'version':73C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Applications that use armeria-saml to handle SAML single sign-on and send users back to a URL taken from the RelayState parameter are exposed. Applications that do not use armeria-saml, or that do not use RelayState for redirects, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["armeriasaml","java","medium","package","saml","sso"],"campaign_type":null,"first_public_at":"2026-10-27T15:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dl_cve@linecorp.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-11753","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11753","severity":null,"published_at":"2026-11-04T06:17:03+00:00","modified_at":"2026-11-04T06:17:03+00:00","first_seen_at":"2026-11-04T06:25:20+00:00","fetched_at":"2026-11-04T06:25:20+00:00","note":null}],"documents":[{"id":6717,"url":"https://github.com/asvorg/CVE-2026-117532-poc","title":"asvorg/CVE-2026-117532-poc","kind":"poc","source":"github","publisher":null,"text":"\n\nstars 0","published_at":"2026-10-27T15:17:19+00:00","relation":"poc","confidence":null,"note":null},{"id":64642,"url":"https://github.com/line/armeria/security/advisories/GHSA-89cp-657f-wp7v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T11:35:41+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}