Missing Token Replay Detection in Saml2 Authentication services for ASP.NET
Impact
Token Replay Detection is an important defence in depth measure for Single Sign On solutions. In all previous 2.X versions, the Token Replay Detection is not properly implemented.
Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use.
Patches
The 2.5.0 version is patched.
Workarounds
There are no workarounds with existing versions. Fixing the issue requires code updates.
References
https://en.wikipedia.org/wiki/Replay_attack
For more information
If you have any questions or comments about this advisory:
- Comment on #711.
- Email us at security@sustainsys.com if you think that there are further security issues.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| .NET (NuGet) | Sustainsys.Saml2 | >= 2.0.0, < 2.5.0 | 2.5.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N- Weakness (CWE)
CWE-294- Platform
- .NET (NuGet)
- Package
Sustainsys.Saml2- Disclosed
- 25.03.2020
- Updated
- 11.10.2026 11:23
Sources and licenses
OSV / GitHub Advisory Database - GHSA-g6j2-ch25-5mmv - CC BY 4.0
Vulnerability history: Sustainsys.Saml2
All published vulnerabilities of this package (.NET (NuGet)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 3
- First → latest
- 03.2020 09.2023
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 2
- Medium 1
Disclosures per year
- 2020: 2
- 2021: 0
- 2022: 0
- 2023: 1
- 2024: 0
- 2025: 0
- 2026: 0
-
Missing Token Replay Detection in Saml2 Authentication services for ASP.NET this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.