When Grafana Enterprise allows IdP-initiated login, the SAML library skips validating the InResponseTo field on all SAML responses, removing anti‑replay protection; an attacker who obtains a valid signed SAML assertion can replay it to log in as the victim, achieving unauthorized session hijacking without additional credentials

This flaw affects Grafana Enterprise installations that have the allow_idp_initiated setting enabled. Grafana OSS and instances with the setting disabled are not impacted

The vulnerability carries a CVSS score of 6.8, indicating moderate severity. EPSS data is unavailable and the issue is not listed in the CISA KEV catalog. The attack requires the attacker to acquire a valid signed assertion, which can be achieved through phishing or token leakage; the replay can then occur over the SAML service provider channel, giving the attacker a full authenticated session on the target instance. Because the setting is off by default, the risk is limited to environments that have deliberately enabled IdP‑initiated login.