CVE-2026-86696: esaml 0.1.0 to before *

Affected technology

esaml · be692b56245071899757afa7ef47e43593d3de96 to before *
handnot2

esaml · 0.1.0 to before *
dropbox

Component: esaml, esaml_sp, esaml_cowboy
Function: esaml:status_code_map/1, esaml:decode_logout_response/1, esaml_sp:validate_logout_response/2, esaml_cowboy:validate_logout/2
File: src/esaml.erl, src/esaml_sp.erl, src/esaml_cowboy.erl

Attack conditions (Source advisory, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Source advisory’s CVSS 4.0 assessment (base score 8.2/10) rates confidentiality and integrity impact as none; availability impact as high. The description does not specify what an attacker can achieve beyond these rated impacts.