Assertion replay is the reuse of a previously valid authentication assertion, such as a SAML response, when the receiving system should reject it. Assertions are issued by an identity provider and used by a service provider to establish a user’s identity. Replay defenses typically check that an assertion is intended for the service, remains within its validity period, and has not already been used.
In an attack, someone who obtains a valid assertion may try to present it again to gain access without completing a fresh login. Weak validation or missing reuse controls can turn a federated sign-in boundary into an authentication bypass. Defenders should apply vendor updates, validate assertion signatures and audience and time constraints, track assertion identifiers to prevent reuse, and review authentication logs for suspicious repeated sign-ins. A replay-style flaw is one possible failure mode; its presence in a particular product should not be assumed without confirmation.