CVE-2026-11749 in Armeria SAML
Summary
by MITRE • 11/04/2026
A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The security flaw resides within the SAML authentication module of Armeria versions preceding 1.41.1, specifically concerning the handling and validation of SAML bearer assertions. In a standard Security Assertion Markup Language flow, particularly when utilizing OAuth2 or similar token-based integrations facilitated by this library, identity providers issue access tokens that are often bound to specific assertion IDs from the underlying authentication event. The critical technical deficiency here is the absence of enforcement mechanisms for one-time use policies regarding these bearer assertions. When a client presents an assertion ID during the authentication handshake, the system fails to maintain state or track whether that specific identifier has already been processed and consumed in a prior session. This oversight means that if an attacker intercepts a valid SAML response containing an access token bound to a particular assertion ID, they can reuse this exact credential payload multiple times as long as it remains within its declared validity period. The vulnerability stems from the lack of idempotency checks or nonce validation logic in the token exchange process, which is essential for preventing replay attacks where previously authenticated sessions are hijacked and re-executed to gain unauthorized access.
The operational impact of this vulnerability allows an adversary to perform a classic replay attack against the authentication infrastructure. By capturing network traffic during a legitimate user login sequence, an attacker can extract the SAML assertion or the resulting access token associated with it. Since the system does not invalidate the assertion ID after its first successful use, the captured credentials remain functional for subsequent requests within the validity window defined by the identity provider. This effectively grants persistent unauthorized access to protected resources without requiring further authentication steps such as password entry or multi-factor verification. The severity is compounded if the compromised token possesses elevated privileges or provides access to sensitive data stores, allowing the attacker to impersonate the legitimate user indefinitely until the token expires or manual intervention occurs. Such scenarios pose significant risks to confidentiality and integrity of application data, potentially leading to account takeover and unauthorized transactions depending on the specific use case of the Armeria service.
From a classification perspective, this issue aligns with CWE-294, which describes authentication bypass by capture-replay attacks, as well as CWE-384 regarding session fixation through lack of proper token invalidation mechanisms. In terms of adversary tactics and techniques, this vulnerability facilitates MITM0016 or similar replay-based exploitation strategies outlined in the ATT&CK framework, where attackers leverage previously captured credentials to maintain persistence within a compromised environment. The failure to enforce one-time use policies represents a fundamental deviation from secure coding practices recommended for identity-aware proxies and API gateways that process SAML assertions.
To mitigate this risk, organizations running Armeria prior to version 1.41.1 must upgrade immediately to the patched release where the logic for enforcing single-use constraints on bearer assertion IDs has been implemented. If immediate upgrading is not feasible due to operational constraints, temporary mitigations should include implementing network-level controls such as strict TLS inspection and anomaly detection systems capable of identifying repeated authentication attempts from identical source IPs or using duplicate token signatures within short time windows. Additionally, reducing the validity period of SAML assertions can limit the window of opportunity for replay attacks, although this must be balanced against user experience considerations. It is also advisable to review logging configurations to ensure that all assertion validations are recorded with sufficient detail to facilitate forensic analysis and rapid detection of any potential exploitation attempts in real-time.