CVE-2024-25718

—

CVSS 3.1

9.8 critical

EPSS

<1%p50

Published

Feb 11, 2024 (Feb 11, 2024)

Modified

Jun 17, 2026

Description

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Vendors: dropbox
Products: samly
Weakness: CWE-613, CWE-400
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.