CVE-2026-53425

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53425", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "state": "PUBLISHED", "assignerShortName": "EEF", "dateReserved": "2026-06-09T11:01:47.529Z", "datePublished": "2026-08-20T17:26:35.537Z", "dateUpdated": "2026-08-21T19:50:34.320Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "samly", "packageURL": "pkg:hex/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "versions": [{"lessThan": "*", "status": "affected", "version": "0.3.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "dropbox/samly", "packageURL": "pkg:github/dropbox/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "versions": [{"lessThan": "*", "status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "versionType": "git"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "handnot2/samly", "packageURL": "pkg:github/handnot2/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/handnot2/samly", "vendor": "handnot2", "versions": [{"lessThan": "*", "status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "credits": [{"lang": "en", "type": "reporter", "value": "Mark Madsen"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.</p>\n<p><code>Samly.SPHandler.validate_authresp/3</code> in <code>lib/samly/sp_handler.ex</code> validates a SAML response for the SP-initiated flow by comparing only the <code>RelayState</code> value, the IdP identifier, and the presence of a target URL held in the session. It never compares <code>SubjectConfirmationData/@InResponseTo</code> against the ID of the <code>AuthnRequest</code> the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose <code>InResponseTo</code> does not match a request it made. The underlying <code>esaml</code> library checks status, signature, recipient, audience, and staleness, but likewise never inspects <code>InResponseTo</code>, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a <code>RelayState</code> matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.</p>\n<p>This issue affects samly: from 0.3.0 onward.</p>"}, {"base64": false, "type": "text/markdown", "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\n`Samly.SPHandler.validate_authresp/3` in `lib/samly/sp_handler.ex` validates a SAML response for the SP-initiated flow by comparing only the `RelayState` value, the IdP identifier, and the presence of a target URL held in the session. It never compares `SubjectConfirmationData/@InResponseTo` against the ID of the `AuthnRequest` the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose `InResponseTo` does not match a request it made. The underlying `esaml` library checks status, signature, recipient, audience, and staleness, but likewise never inspects `InResponseTo`, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a `RelayState` matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward."}], "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\nSamly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward."}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 7.6, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-20T18:38:13.727Z"}, "references": [{"tags": ["related", "third-party-advisory"], "url": "https://cna.erlef.org/cves/CVE-2026-53425.html"}, {"tags": ["related"], "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53425"}], "source": {"discovery": "UNKNOWN"}, "title": "Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:50:24.245049Z", "id": "CVE-2026-53425", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:50:34.320Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-21T19:50:24.245049Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:50:30.104Z"}}], "cna": {"title": "Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Mark Madsen"}, {"lang": "en", "type": "coordinator", "value": "Jonatan M\u00e4nnchen / EEF"}], "impacts": [{"capecId": "CAPEC-62", "descriptions": [{"lang": "en", "value": "CAPEC-62 Cross Site Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "modules": ["'Elixir.Samly.SPHandler'"], "product": "samly", "versions": [{"status": "affected", "version": "0.3.0", "lessThan": "*", "versionType": "semver"}], "packageURL": "pkg:hex/samly", "packageName": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "collectionURL": "https://repo.hex.pm", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {"cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "modules": ["'Elixir.Samly.SPHandler'"], "product": "samly", "versions": [{"status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/dropbox/samly", "packageName": "dropbox/samly", "programFiles": ["lib/samly/sp_handler.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}, {"cpes": ["cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*"], "repo": "https://github.com/handnot2/samly", "vendor": "handnot2", "modules": ["'Elixir.Samly.SPHandler'"], "product": "samly", "versions": [{"status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "lessThan": "*", "versionType": "git"}], "packageURL": "pkg:github/handnot2/samly", "packageName": "handnot2/samly", "programFiles": ["lib/samly/sp_handler.ex"], "collectionURL": "https://github.com", "defaultStatus": "unaffected", "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}]}], "references": [{"url": "https://cna.erlef.org/cves/CVE-2026-53425.html", "tags": ["related", "third-party-advisory"]}, {"url": "https://osv.dev/vulnerability/EEF-CVE-2026-53425", "tags": ["related"]}], "descriptions": [{"lang": "en", "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\nSamly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward.", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.</p>\n<p><code>Samly.SPHandler.validate_authresp/3</code> in <code>lib/samly/sp_handler.ex</code> validates a SAML response for the SP-initiated flow by comparing only the <code>RelayState</code> value, the IdP identifier, and the presence of a target URL held in the session. It never compares <code>SubjectConfirmationData/@InResponseTo</code> against the ID of the <code>AuthnRequest</code> the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose <code>InResponseTo</code> does not match a request it made. The underlying <code>esaml</code> library checks status, signature, recipient, audience, and staleness, but likewise never inspects <code>InResponseTo</code>, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a <code>RelayState</code> matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.</p>\n<p>This issue affects samly: from 0.3.0 onward.</p>", "base64": false}, {"type": "text/markdown", "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\n`Samly.SPHandler.validate_authresp/3` in `lib/samly/sp_handler.ex` validates a SAML response for the SP-initiated flow by comparing only the `RelayState` value, the IdP identifier, and the presence of a target URL held in the session. It never compares `SubjectConfirmationData/@InResponseTo` against the ID of the `AuthnRequest` the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose `InResponseTo` does not match a request it made. The underlying `esaml` library checks status, signature, recipient, audience, and staleness, but likewise never inspects `InResponseTo`, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a `RelayState` matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "0.3.0"}, {"criteria": "cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "0.3.0"}], "operator": "OR"}], "operator": "AND"}], "providerMetadata": {"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "shortName": "EEF", "dateUpdated": "2026-08-20T18:38:13.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53425", "state": "PUBLISHED", "dateUpdated": "2026-08-21T19:50:34.320Z", "dateReserved": "2026-06-09T11:01:47.529Z", "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "datePublished": "2026-08-20T17:26:35.537Z", "assignerShortName": "EEF"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.hex.pm", "cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "samly", "packageURL": "pkg:hex/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "versions": [{"lessThan": "*", "status": "affected", "version": "0.3.0", "versionType": "semver"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:dropbox:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "dropbox/samly", "packageURL": "pkg:github/dropbox/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/dropbox/samly", "vendor": "dropbox", "versions": [{"lessThan": "*", "status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "versionType": "git"}]}, {"collectionURL": "https://github.com", "cpes": ["cpe:2.3:a:handnot2:samly:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "modules": ["'Elixir.Samly.SPHandler'"], "packageName": "handnot2/samly", "packageURL": "pkg:github/handnot2/samly", "product": "samly", "programFiles": ["lib/samly/sp_handler.ex"], "programRoutines": [{"name": "'Elixir.Samly.SPHandler':consume_signin_response/1"}], "repo": "https://github.com/handnot2/samly", "vendor": "handnot2", "versions": [{"lessThan": "*", "status": "affected", "version": "8a5bb1b4a4753d05470da2036323477f63cfdf4c", "versionType": "git"}]}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authenticated session using a SAML response the service provider never requested.\n\nSamly.SPHandler.validate_authresp/3 in lib/samly/sp_handler.ex validates a SAML response for the SP-initiated flow by comparing only the RelayState value, the IdP identifier, and the presence of a target URL held in the session. It never compares SubjectConfirmationData/@InResponseTo against the ID of the AuthnRequest the service provider issued, and that request ID is never persisted, so no comparison is possible. SAML 2.0 Core section 4.1.4.3 requires a service provider to reject a response whose InResponseTo does not match a request it made. The underlying esaml library checks status, signature, recipient, audience, and staleness, but likewise never inspects InResponseTo, so nothing else closes the gap. Exploitation requires a validly signed assertion from the trusted IdP, which an attacker can obtain for their own account, and a RelayState matching the victim's session; the assertion signature itself remains intact, so this is not a signature-forgery issue.\n\nThis issue affects samly: from 0.3.0 onward."}, {"lang": "es", "value": "Vulnerabilidad de verificaci\u00f3n insuficiente de la autenticidad de los datos en samly de dropbox permite a un atacante establecer una sesi\u00f3n autenticada utilizando una respuesta SAML que el proveedor de servicios nunca solicit\u00f3.\n\nSamly.SPHandler.validate_authresp/3 en lib/samly/sp_handler.ex valida una respuesta SAML para el flujo iniciado por el SP comparando solo el valor de RelayState, el identificador del IdP y la presencia de una URL de destino mantenida en la sesi\u00f3n. Nunca compara SubjectConfirmationData/@InResponseTo con el ID de la AuthnRequest que el proveedor de servicios emiti\u00f3, y ese ID de solicitud nunca se persiste, por lo que no es posible ninguna comparaci\u00f3n. La secci\u00f3n 4.1.4.3 del n\u00facleo de SAML 2.0 requiere que un proveedor de servicios rechace una respuesta cuyo InResponseTo no coincida con una solicitud que realiz\u00f3. La biblioteca esaml subyacente verifica el estado, la firma, el destinatario, la audiencia y la caducidad, pero de manera similar nunca inspecciona InResponseTo, por lo que nada m\u00e1s cierra la brecha. La explotaci\u00f3n requiere una aserci\u00f3n v\u00e1lidamente firmada del IdP de confianza, que un atacante puede obtener para su propia cuenta, y un RelayState que coincida con la sesi\u00f3n de la v\u00edctima; la firma de la aserci\u00f3n en s\u00ed permanece intacta, por lo que esto no es un problema de falsificaci\u00f3n de firma.\n\nEste problema afecta a samly: a partir de la versi\u00f3n 0.3.0."}], "id": "CVE-2026-53425", "lastModified": "2026-10-26T10:10:00.140", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53425", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:50:24.245049Z", "version": "2.0.3"}}]}, "published": "2026-08-20T18:16:27.850", "references": [{"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://cna.erlef.org/cves/CVE-2026-53425.html"}, {"source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "url": "https://osv.dev/vulnerability/EEF-CVE-2026-53425"}], "sourceIdentifier": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.3.0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "samly", "source": "cna", "vendor": "dropbox"}, "product": "samly", "vendor": "dropbox"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8a5bb1b4a4753d05470da2036323477f63cfdf4c"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "samly", "source": "cna", "vendor": "dropbox"}, "product": "samly", "vendor": "dropbox"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "8a5bb1b4a4753d05470da2036323477f63cfdf4c"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}]}, "product": "samly", "vendor": "handnot2"}], "created": "2026-08-20T20:30:05.829038+00:00", "updated": "2026-08-21T13:01:23.237245+00:00", "vendors": ["dropbox", "dropbox$PRODUCT$samly", "handnot2", "handnot2$PRODUCT$samly"]}