CVE-2026-11749

HighCVSS 7.6/10Last modified Nov 6, 2026

Description

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.

Metrics

CVSS 4.0 7.6/10

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1174938.3Stored Cross-Site Scripting (XSS) in Sisense BloX widgets, in all versions, both on Sisense Cloud and in self-hosted deployments, allows an CVE-2026-1174993.7@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that r CVE-2026-11757.5A vulnerability was identified in birkir prime up to 0.4.0.beta.0. This impacts an unknown function of the file /graphql of the component Gr CVE-2026-1175007.5HTTP::Body versions before 1.24_01 for Perl allow CPU exhaustion via regex backtracking on the filename of a multipart upload. For every fi CVE-2026-1175017.5HTTP::Body versions before 1.24_01 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies. In chunked mode, use CVE-2026-1175035.3A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component CVE-2026-1175045.3A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/d CVE-2026-1175054.3A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the compon CVE-2026-1175064.3A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setIn CVE-2026-1175075.4A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. Th CVE-2026-1175096.3A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/pers CVE-2026-117519.1A vulnerability has been identified in armeria-xds versions prior to 1.41.0, where xDS upstream TLS peer verification may be silently disabl