handnot2/samly

Releases22

Frequency3 weeks 5 days

Last Release over 7 years ago

Stars135

Elixir Plug library to enable SAML 2.0 SP SSO in Phoenix/Plug applications.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-25718 ↗	Feb 11, 2024Sunday, 11 February 2024, 05:15	9.8 CRITICAL	—
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.