srl
SAML Attacks
Security Assertion Markup Language (SAML) is an XML-based standard for authentication and authorization between parties, widely used to implement Single Sign-On (SSO). Data is exchanged in digitally signed XML documents, and the security of the entire federation rests on one assumption: the element the Service Provider cryptographically verifies is the same element its application code reads the username from.
2025–2026 context: SAML is built on XML, and XML’s parser complexity has produced a persistent stream of critical authentication-bypass CVEs across every major language ecosystem. The 2025 PortSwigger “Fragile Lock” research introduced attribute pollution, namespace confusion, and Void Canonicalization as new XSW classes. The current CVE feed is dominated by signature wrapping in libraries (authentik, Net::SAML2, ruby-saml, Nokogiri), replay and missing Conditions validation (Casdoor, Logto, Snipe-IT, Keycloak), and XML comment injection (authentik).