The Fragile Lock: Novel Bypasses For SAML Authentication
Summary: PortSwigger researcher Zak Fedotkin published research on December 10, 2025, showing full authentication bypass in the Ruby and PHP SAML ecosystem by exploiting parser-level inconsistencies between REXML and Nokogiri, including attribute pollution, namespace confusion, and a new class of Void Canonicalization attacks. The work builds on the Ruby-SAML 1.12.4 patch as a case study, demonstrating that its DTD and well-formedness checks did not address the root cause of two separate XML parsers handling signature verification and assertion processing.
Bottom line: The attack requires no stolen signed assertion: an attacker reuses any other XML document signed with the IdP's private key, and the demo bypasses authentication on a vulnerable GitLab EE 17.8.4 instance. If your SSO depends on SAML libraries that split signature verification and assertion parsing across different XML parsers, the patch history suggests incremental fixes have not closed the gap.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026