CVE-2020-5261 - CVE House
Back to Database
Status published High CVE-2020-5261

Missing Token Replay Detection

Vulnerability Description

Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 has a faulty implementation of Token Replay Detection. Token Replay Detection is an important defence in depth measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 is not affected. It has a correct Token Replay Implementation and is safe to use. Saml2 Authentication services for ASP.NET (NuGet package Sustainsys.Saml2) greater than 2.0.0, and less than version 2.5.0 have a faulty implementation of Token Replay Detection. Token Replay Detection is an important defense measure for Single Sign On solutions. The 2.5.0 version is patched. Note that version 1.0.1 and prior versions are not affected. These versions have a correct Token Replay Implementation and are safe to use.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-5261

Credits & Attribution

No credits recorded in the NVD database.

References

More from Sustainsys

View All →
CVE-2023-41890
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation
High 7.5
CVE-2020-5268
Subject Confirmation Method not validated in Saml2 Authentication Services for ASP.NET
Medium 6.5

Affected Vendor

Affected Software

Saml2
Vulnerable Versions:
>= 2.0.0, < 2.5.0

Timeline

Official Publish: March 25th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.