Notifications
Clear all
Topic starter
01/08/2026 10:51 pm
TL;DR: Parser-level inconsistencies in Ruby and PHP SAML libraries can enable complete authentication bypass through attribute pollution, namespace confusion, and void canonicalization, even when XML signatures appear valid, according to PortSwigger. The deeper problem is that SAML security still depends on fragile parser agreement that incremental patching does not reliably fix.
NHIMG editorial — based on content published by PortSwigger: The Fragile Lock: Novel Bypasses For SAML Authentication
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: What breaks when SAML signature validation and assertion parsing use different XML libraries?
A: The verifier can confirm a signature on one XML object while the application consumes identity claims from another.
Q: Why do namespace and attribute handling errors matter in SAML deployments?
A: Because SAML security depends on selecting the right signed element every time.
Q: How do security teams test for SAML authentication bypass risk?
A: They should use adversarial test cases that include wrapped assertions, duplicate attributes, namespace confusion, malformed signatures, and canonicalisation edge cases.
Practitioner guidance
- Audit every SAML parser boundary Inventory where signature verification, schema validation, and assertion extraction occur in the same application path.
- Reject namespace-ambiguous identity attributes Block documents containing duplicate ID-like attributes, conflicting namespace declarations, or XPath selections that rely on simple-name lookup instead of namespace-aware matching.
- Treat canonicalisation errors as auth failures Fail closed when digest computation, schema validation, or XML canonicalisation returns an unexpected result.
What's in the full report
PortSwigger's full post covers the parser-level exploit mechanics this post intentionally leaves for the source:
- Step-by-step exploit construction for Ruby and PHP SAML libraries, including the parser discrepancy chain
- Detailed examples of attribute pollution, namespace confusion, and void canonicalisation in live XML payloads
- Proof-of-concept workflow against a vulnerable GitLab EE instance and the associated tooling notes
- Patch timeline and maintainer responses for the affected SAML and XML libraries
👉 Read PortSwigger's analysis of novel SAML authentication bypasses →
SAML signature bypasses: are your authentication controls keeping up?
Explore further
01/08/2026 10:59 pm
SAML parser trust is a governance problem, not just a code defect. Identity programmes often assume that signature verification and claim extraction operate on the same document interpretation. This article shows that assumption fails when separate XML parsers disagree about namespaces, attributes, or canonical form. The implication is that SAML assurance must be evaluated as an end-to-end trust chain, not as isolated cryptographic validation.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how weak identity inventory remains across many environments.
A question worth separating out:
Q: Who is accountable when a SAML parser flaw leads to unauthorised access?
A: Accountability sits with the service owner, the identity platform owner, and the team that ships or maintains the consuming application. Federated identity does not transfer responsibility to the IdP alone, because the failure often occurs in the service provider’s validation path and library choices.
👉 Read our full editorial: SAML parser inconsistencies can still bypass authentication controls
