Idyll

**Name of the Vulnerable Software and Affected Versions** Samly package versions prior to 1.4.0 for Elixir **Description** The issue arises from the `Samly.State.Store.get assertion/3` function, which can return an expired session. This interferes with access control because `Samly.AuthHandler` uses a cached session and does not replace it, even after expiry. **Recommendations** For versions prior to 1.4.0, update to version 1.4.0 or later to resolve the issue. As a temporary workaround, consider disabling the `Samly.State.Store.get assertion/3` function until a patch is available. Restrict access to the `Samly.AuthHandler` to minimize the risk of exploitation.