SAML: A fractal of bad design
Summary: A Trail of Bits post argues that SAML, created in 2002 by the OASIS Security Services Technical Committee, should be deprecated in favor of OpenID Connect because it is built on XML signature validation and canonicalization that remain vulnerable to XML signature wrapping attacks first documented in the 2012 paper "On Breaking SAML: Be Whoever You Want to Be." The author notes that 99% of modern SAML implementations use a similar data shape and avoid roughly 90% of the specification, and that SAML failed to anticipate the mobile, SPA, and IoT shifts and the 2014 move toward zero trust.
Key Takeaway: XML signature wrapping, a bug class known since 2012, is still present in fielded SAML implementations today, and most of them wrap libxmlsec, a C codebase the post says nobody reads.
Read the original at Trail of Bits Blog ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026