Is CVE-2026-11753 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11753 being exploited in the wild.

How severe is CVE-2026-11753?

Informational severity, published 4 November 2026.

Which products and versions are affected?

LINE Armeria SAML before 1.41.1.

How is CVE-2026-11753 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-11753?

Check whether you run LINE Armeria SAML at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11753: Armeria SAML open redirect in RelayState validation

CVE-2026-11753 · Severity: info · Published 2026-11-04

Armeria is an open-source framework used to build microservices and web applications with SAML single sign-on (SSO) support. A flaw in the default SAML handler allows attackers to craft malicious login links that redirect authenticated users to attacker-controlled websites after they successfully log in, enabling phishing and credential theft while appearing legitimate.

Vendors: LINE.

Quick answers

Is CVE-2026-11753 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11753 being exploited in the wild.
How severe is CVE-2026-11753?: Informational severity, published 4 November 2026.
Which products and versions are affected?: LINE Armeria SAML before 1.41.1.
Is there a fix for CVE-2026-11753?: Yes: fixed in 1.41.1. Until then: Use a custom SAML SSO handler that validates RelayState by accepting only relative paths starting with a single forward slash, rejecting protocol-relative URLs (//host), absolute URLs (https://host/...), and dangerous schemes (javascript:, data:, etc.). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11753 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-11753?: Check whether you run LINE Armeria SAML at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.41.1

Use a custom SAML SSO handler that validates RelayState by accepting only relative paths starting with a single forward slash, rejecting protocol-relative URLs (//host), absolute URLs (https://host/...), and dangerous schemes (javascript:, data:, etc.).

Technical details

The vulnerability exists in Armeria's default SamlSingleSignOnHandler, which reflects the RelayState parameter directly into the HTTP Location header without validation. RelayState is an opaque, attacker-controlled value round-tripped by the identity provider; the handler accepts absolute URLs, protocol-relative URLs, and javascript: schemes, allowing unvalidated redirects after SAML authentication succeeds. This affects only applications using the default handler; custom handlers that validate RelayState are not affected.

Affected products

LINE Armeria SAML before 1.41.1

Timeline

2026-11-03: disclosed
2026-11-04: advisory
2026-11-04: patched: version 1.41.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.