CVE-2024-25718

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-613 CWE-400

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
samly	elixr	< 1.4.0

References

https://diff.hex.pm/diff/samly/1.3.0..1.4.0Patch
https://github.com/dropbox/samlyProduct
https://github.com/dropbox/samly/pull/13Patch
https://github.com/dropbox/samly/pull/13/commits/812b5c3ad076dc9c9334c1a560c8e6470607d1ebPatch
https://github.com/handnot2/samlyProduct
https://hex.pm/packages/samlyRelease Notes
https://diff.hex.pm/diff/samly/1.3.0..1.4.0Patch
https://github.com/dropbox/samlyProduct
https://github.com/dropbox/samly/pull/13Patch
https://github.com/dropbox/samly/pull/13/commits/812b5c3ad076dc9c9334c1a560c8e6470607d1ebPatch
https://github.com/handnot2/samlyProduct
https://hex.pm/packages/samlyRelease Notes

Timeline

Published: Feb 11, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-25729.8A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unkn CVE-2024-257229.8qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.CVE-2024-257238.8ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{us CVE-2024-257247.3In RTI Connext Professional 5.3.1 through 6.1.0 before 6.1.1, a buffer overflow in XML parsing from Routing Service, Recording Service, Queu CVE-2024-257287.5ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends t CVE-2024-257298.8Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (They use the first 6 CVE-2024-25739.8A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function CVE-2024-257309.8Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, CVE-2024-257317.5The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a CVE-2024-257347.5An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid usernam CVE-2024-257359.1An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /devi CVE-2024-257367.5An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET req