Executive brief
Relyra is a software library used by Elixir and Phoenix applications to handle secure logins via SAML. A flaw in the library's security checks allows an attacker to bypass authentication by providing a forged login response that the library fails to verify cryptographically. This could allow an unauthorized person to log into an application as any user, potentially leading to full account takeover and access to sensitive data.
Technical details
An authentication bypass vulnerability exists in Relyra versions 1.0.0 and 1.1.0 due to incomplete XMLDSig verification. The library failed to perform cryptographic verification of the 'SignatureValue' against the Identity Provider's (IdP) public key and did not recompute the 'DigestValue' over canonicalized elements. Instead, it followed a structure-only acceptance path that validated the document shape without proving the integrity of the signature bytes. A remote, unauthenticated attacker can exploit this by crafting a forged SAML response with an arbitrary NameID to gain unauthorized access to relying-party applications. The issue is resolved in version 1.2.0, which implements proper exclusive-C14N canonicalization and signature verification.
Affected products
- szTheory relyra >= 1.0.0, < 1.2.0
Timeline
- 2026-05-24: patched: Fix commits 2e45689 and 8910200 authored.
- 2026-05-25: disclosed: Advisory published by szTheory.
- 2026-06-18: kev added: Published to NVD.
- 2026-06-26: advisory: GitHub Advisory reviewed and updated.