diff --git a/docs/resources/release-notes/2026-09-08.mdx b/docs/resources/release-notes/2026-09-08.mdx
index 9efa0eb0..1a61f285 100644
--- a/docs/resources/release-notes/2026-09-08.mdx
+++ b/docs/resources/release-notes/2026-09-08.mdx
@@ -231,6 +231,16 @@ import FeatureFlagNote from '/snippets/feature-flag-so-managed.mdx';
 </Update>
 
 <Update label="BloodHound" tags={["Fixed Issues"]}>
+  ## Authentication
+
+  {/*BED-9064*/} **SAML replay protection:** Resolved an issue where a valid signed SAML response could be replayed to create multiple BloodHound sessions.
+
+  BloodHound now records both the SAML response ID and assertion ID before creating a session. Any later callback that reuses either identifier is rejected.
+
+  <Callout icon="heart" color="#FFB74D">
+    Special thanks to Corban Villa, Sohee Kim, and Austin Chu for their detailed report and responsible disclosure.
+  </Callout>
+
   ## Cypher
 
   - {/*BED-8955*/} Resolved an issue where Cypher queries using traversal expansion to find a cyclical loop could fail.
diff --git a/docs/resources/release-notes/summary.mdx b/docs/resources/release-notes/summary.mdx
index e23300f6..edccb698 100644
--- a/docs/resources/release-notes/summary.mdx
+++ b/docs/resources/release-notes/summary.mdx
@@ -61,7 +61,7 @@ Key highlights include:
 
 ### <Icon icon="wrench" /> Fixed Issues
 
-See the [release notes](/resources/release-notes/2026-09-08#cypher) for a full list of fixed issues in this release.
+See the [release notes](/resources/release-notes/2026-09-08#bloodhound-10) for a full list of fixed issues in this release.
 
 ## 2026-08-18