Dropbox samly

• CVE-2026-53424 Critical 9.1 Missing one-time-use enforcement in Samly allows replay of SAML bearer assertions 0.6%
• CVE-2026-53425 High 7.6 Missing InResponseTo validation in Samly allows acceptance of unsolicited SAML responses 0.2%