A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of pre

Summary

A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing replay of previously consumed assertion IDs within their validity period.

Remediation

1. Inventory every LY Corporation Armeria deployment, including staging.
2. Upgrade LY Corporation Armeria to 1.41.1.
3. Confirm the running version after the upgrade.

References

• Referencehttps://line.github.io/security-advisory-blog/CVE-2026-11749/
• Referencehttps://github.com/line/armeria/security/advisories/GHSA-v86g-h7gx-q845