CVE-2026-49454 Details
Description
Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept forged SAML signatures because SignatureValue was not cryptographically verified before the library returned a successful authentication result. The XMLDSig trust boundary was incomplete as :public_key.verify over the exclusive-C14N canonicalized SignedInfo was not performed against the configured IdP certificate's public key, DigestValue was not recomputed over the canonicalized referenced element, and canonicalize/2 remained an unused passthrough in the signature-verification path. The result was a structure-only acceptance path where document shape and trust-source rejection could succeed without proving the signature bytes. A forged SignatureValue carrying an attacker-controlled NameID could be accepted as {:ok}. This issue has been fixed in version 1.2.0.
An authentication bypass vulnerability has been identified in the Relyra SAML 2.0 Service Provider library for Elixir and Phoenix, specifically in versions 1.0.0 and 1.1.0. The vulnerability arises because the library did not cryptographically verify the 'SignatureValue' before confirming authentication. This oversight allowed forged SAML signatures to be accepted. The issue stemmed from an incomplete XML Digital Signature (XMLDSig) trust boundary, where critical verification steps were either not performed or improperly handled. As a result, an attacker could exploit this flaw by manipulating the 'SignatureValue' to include a controlled 'NameID', leading to unauthorized access as a legitimate user.
Upgrade to Relyra version 1.2.0 or later, which addresses the vulnerability by implementing proper signature verification and trust boundary controls.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 18, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/szTheory/relyra/commit/2e456897af3158c175bb490ce7fc51d6241c8922 | [email protected] | Source CodeVendor |
| https://github.com/szTheory/relyra/commit/8910200 | [email protected] | Source CodeVendor |
| https://github.com/szTheory/relyra/security/advisories/GHSA-jv46-xfwm-36j7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Relyra | >= 1.0.0, < 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 18, 2026 | New CVE Received | [email protected] |