The vulnerability lies in Relyra’s SAML 2.0 Service Provider library, which does not cryptographically verify the SignatureValue field of inbound SAML assertions. Because the library skips proper validation of the SignedInfo element, an attacker can send a forged signature that carries a malicious NameID and have the library accept it as a successful authentication. The primary consequence is that the attacker can impersonate any user, gaining unauthorized access to resources protected by the application. The weakness corresponds to CWE‑287, Authentication Bypass, and CWE‑347, Missing Signature Verification.

The impacted product is szTheory’s Relyra library used in Elixir and Phoenix web applications. Versions 1.0.0 and 1.1.0 lack the necessary signature checks and therefore are vulnerable. The fix is available in 1.2.0, which implements the missing cryptographic validation. Any project that has integrated these vulnerable versions without applying the patch is at risk.

The CVSS score of 9.1 indicates a high severity level, reflecting remote exploitation that could lead to unauthorized authorization. Although the EPSS score is not available, the lack of a CISA KEV listing suggests no widespread exploitation has been documented yet, but the vulnerability remains a significant threat. The attack vector likely involves sending a crafted SAML response from an attacker-controlled IdP or intercepting a legitimate response, as the library fails to check the signature bytes. Successful exploitation requires only that the forged assertion reach the application, making the risk high for exposed services.