CVE-2026-11753 — Vulnerability intelligence

—

Published: 2026-11-04T06:17:03.997

CVSS

5.1

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is reflected into the HTTP Location header after successful authentication, allowing an unvalidated redirect to an attacker-controlled URL.

Sources

• CVE-2026-11753
• Original advisory
• Original advisory