CVE-2020-5261

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

• CWE-294
• CWE-294

• https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241Patch, Third Party Advisory
• https://github.com/Sustainsys/Saml2/issues/711Issue Tracking, Third Party Advisory
• https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmvThird Party Advisory
• https://github.com/Sustainsys/Saml2/commit/e58e0a1aff2b1ead6aca080b7cdced55ee6d5241Patch, Third Party Advisory
• https://github.com/Sustainsys/Saml2/issues/711Issue Tracking, Third Party Advisory
• https://github.com/Sustainsys/Saml2/security/advisories/GHSA-g6j2-ch25-5mmvThird Party Advisory

Published

Mar 25, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-5255In Symfony before versions 4.4.7 and 5.0.7, when a `Response…4.3
• CVE-2020-5256BookStack before version 0.25.5 has a vulnerability where a …8.8
• CVE-2020-5257In Administrate (rubygem) before version 0.13.0, when sortin…8.1
• CVE-2020-5258In affected versions of dojo (NPM package), the deepCopy met…7.7
• CVE-2020-5259In affected versions of dojox (NPM package), the jqMix metho…8.6
• CVE-2020-5260Affected versions of Git have a vulnerability whereby Git ca…7.5
• CVE-2020-5262In EasyBuild before version 4.1.2, the GitHub Personal Acces…5.5
• CVE-2020-5263auth0.js (NPM package auth0-js) greater than version 8.0.0 a…4.9
• CVE-2020-5264In PrestaShop before version 1.7.6.5, there is a reflected X…6.1
• CVE-2020-5265In PrestaShop between versions 1.7.6.1 and 1.7.6.5, there is…6.1
• CVE-2020-5266In the ps_link module for PrestaShop before version 3.1.0, t…5.4
• CVE-2020-5267In ActionView before versions 6.0.2.2 and 5.2.4.2, there is …4.8