The vulnerability originates from a missing validation of the InResponseTo attribute in SAML responses. Because the Service Provider does not compare this attribute with the identifier of the AuthnRequest it issued, an attacker can send an unsolicited SAML response and have the system accept it as valid. This enables an attacker to establish an authenticated session for themselves without a legitimate authentication request, effectively bypassing the intended authentication flow. The flaw is a classic example of CWE‑345 “Missing Message Authentication.”

The issue affects the Dropbox Samly and Handnot2 Samly libraries, both beginning with version 0.3.0 onward. Users running any release in this series are potentially vulnerable if they rely on the SP‑initiated authentication flow without additional safeguards.

The CVSS score of 7.6 labels this a high‑severity vulnerability, and although the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation has been documented yet. Nevertheless, an attacker only needs a validly signed assertion from their own account and a RelayState that matches a victim's active session to exploit the flaw, which is a realistic threat in environments where SAML assertions are not tightly bound to requests.