SAMLjacking

Expanded Definition

SAMLjacking sits at the intersection of identity federation abuse and configuration tampering. In a normal SAML flow, a trusted service provider relies on an identity provider to authenticate the user and issue assertions. In a SAMLjacking scenario, an attacker changes the federation configuration, or abuses weak administrative controls, so sign-in traffic is redirected to an attacker-controlled identity provider while the user still believes the login process is legitimate.

The term is used in the NHI and IAM domain to describe attacks against trust relationships, not weaknesses in the SAML protocol itself. That distinction matters because the failure is usually governance related: overbroad admin access, weak change verification, and insufficient monitoring of federation settings. Industry usage is still evolving, so some teams describe the same pattern as federation hijacking or IdP abuse. For baseline control expectations around identity and access governance, NIST SP 800-53 Rev. 5 Security and Privacy Controls is a useful external reference.

The most common misapplication is treating SAMLjacking as a generic phishing event, which occurs when defenders ignore the configuration change that made the attacker-controlled IdP possible.

Examples and Use Cases

Implementing federation securely often introduces operational friction, because every change to an IdP or trust policy must be checked without slowing legitimate authentication work.

• A malicious admin updates the SAML metadata for a SaaS application so authentication requests are sent to a rogue identity provider.
• A compromised support account modifies federation settings after a helpdesk workflow grants it excessive privileges.
• An attacker replaces a certificate or signing key in the trust chain, causing users to accept assertions from an unauthorized source.
• Security teams detect unexpected changes after reviewing the application’s identity settings and compare them against known-good configuration baselines.

For a real-world look at how identity misuse can unfold across infrastructure, the Hugging Face Spaces breach shows why visibility into identity-controlled paths matters. The same governance problem appears in regulated environments where NIST SP 800-53 Rev 5 Security and Privacy Controls expects controlled change management and access oversight. SAMLjacking is most often discussed in incident response when a user reports successful login but the authenticating domain, certificate, or assertion source does not match policy.

Why It Matters in NHI Security

SAMLjacking is important in NHI security because it converts a trusted identity integration into a credential capture and session theft path. The risk is amplified when non-human identities, admin automation, and federation tooling share the same management plane. NHIMG reports that 97% of NHIs carry excessive privileges, which makes any control gap around identity configuration especially dangerous. When privileged service accounts or automation roles can alter federation settings, the blast radius extends beyond one application to the broader identity fabric.

This term also matters because federation abuse can hide inside otherwise legitimate sign-in activity. If monitoring focuses only on password attacks, teams can miss changes to IdP routing, metadata, or signing material. Strong governance requires separation of duties, change approval, and verification of identity trust anchors after every update. In high-assurance settings, the issue is similar to financial or compliance identity misuse, where the FATF Recommendations show why identity assertions must be attributable and controlled.

Organisations typically encounter the operational impact only after users are redirected through a rogue login path, at which point SAMLjacking becomes unavoidable to investigate and contain.