CVE-2024-25718: Dropbox Samly

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Affected products

• Dropbox Samly: before 1.4.0 (fixed in 1.4.0)

Published 2024-02-11. Last modified 2026-06-17.