Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2026-12704

SAML assertion replay via skipped InResponseTo validation

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Grafana Enterprise

Default version status: unaffected

  • 11.6.0 to ≤ 11.6.17affected
  • 12.2.0 to ≤ 12.2.11affected
  • 12.3.0 to ≤ 12.3.11affected
  • 12.4.0 to ≤ 12.4.10affected
  • 13.0.0 to ≤ 13.0.7affected
  • 13.1.0 to ≤ 13.1.4affected
  • 13.2.0 to ≤ 13.2.0affected

References