# CVE-2026-11753: Armeria SAML open redirect in RelayState validation

Source: https://junglewise.ai/threats/cve-2026-11753-a-vulnerability-has-been-identified-in-armeria-saml-versions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-11753 · Severity: info · Published 2026-11-04

Armeria is an open-source framework used to build microservices and web applications with SAML single sign-on (SSO) support. A flaw in the default SAML handler allows attackers to craft malicious login links that redirect authenticated users to attacker-controlled websites after they successfully log in, enabling phishing and credential theft while appearing legitimate.

Vendors: [LINE](https://junglewise.ai/threats/vendors/line).

## Quick answers

**Is CVE-2026-11753 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11753 being exploited in the wild.

**How severe is CVE-2026-11753?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** LINE Armeria SAML before 1.41.1.

**Is there a fix for CVE-2026-11753?** Yes: fixed in 1.41.1. Until then: Use a custom SAML SSO handler that validates RelayState by accepting only relative paths starting with a single forward slash, rejecting protocol-relative URLs (//host), absolute URLs (https://host/...), and dangerous schemes (javascript:, data:, etc.). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11753 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11753?** Check whether you run LINE Armeria SAML at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.41.1

Use a custom SAML SSO handler that validates RelayState by accepting only relative paths starting with a single forward slash, rejecting protocol-relative URLs (//host), absolute URLs (https://host/...), and dangerous schemes (javascript:, data:, etc.).

## Technical details

The vulnerability exists in Armeria's default SamlSingleSignOnHandler, which reflects the RelayState parameter directly into the HTTP Location header without validation. RelayState is an opaque, attacker-controlled value round-tripped by the identity provider; the handler accepts absolute URLs, protocol-relative URLs, and javascript: schemes, allowing unvalidated redirects after SAML authentication succeeds. This affects only applications using the default handler; custom handlers that validate RelayState are not affected.

## Affected products

- LINE Armeria SAML before 1.41.1

## Timeline

- 2026-11-03: disclosed
- 2026-11-04: advisory
- 2026-11-04: patched: version 1.41.1 released

## References

- [https://github.com/line/armeria/security/advisories/GHSA-89cp-657f-wp7v](https://github.com/line/armeria/security/advisories/GHSA-89cp-657f-wp7v)
- [https://line.github.io/security-advisory-blog/CVE-2026-11753/](https://line.github.io/security-advisory-blog/CVE-2026-11753/)