SAML Signature Forgery Vulnerability in Relyra Library for Elixir and Phoenix

CVE-2026-49454

What is CVE-2026-49454?

Relyra, a SAML 2.0 Service Provider library for Elixir and Phoenix, has a vulnerability that allows forged SAML signatures to be accepted without proper cryptographic verification. The issue arises from inadequate validation of the SignatureValue, as critical checks against the configured IdP certificate's public key were skipped. This flaw enables an attacker to present a fraudulent SignatureValue with a malicious NameID, resulting in the library erroneously acknowledging the authentication. Version 1.2.0 has been released to remediate this critical oversight.

References