The vulnerability occurs when Samly fails to enforce the SAML 2.0 Web Browser Single Sign‑On Profile requirement that a bearer assertion be used only once. Because the library does not invoke the duplicate‑assertion detector, an attacker who captures a valid SAMLResponse can repeatedly submit the same assertion bytes until the NotOnOrAfter time expires, allowing the attacker to log in as the assertion’s subject. This flaw provides an authentication bypass and unauthorized access to any system that relies on Samly for SAML authentication.

The flaw affects the Samly library from version 0.3.0 onward. Primarily, applications using the Dropbox Samly module or handnot2 Samly module are at risk. All deployments of these libraries that have not been upgraded to a version that implements duplicate‑assertion enforcement are impacted.

The vulnerability receives a CVSS score of 9.1, indicating critical severity. The EPSS score is not available, so the likelihood of exploitation cannot be precisely quantified, but the vulnerability is listed as not present in the CISA KEV catalog. An attacker needs only to obtain a legitimate SAMLResponse through network interception, browser history, or logs, and can replay it without further privileges. Due to the lack of a built‑in duplicate detector, the attacker can reuse the assertion until the NotOnOrAfter timestamp passes, making exploitation straightforward.