Skip to content
The Fragile Lock: Novel Bypasses For SAML Authentication
portswigger.net | research | #appsec | #ruby | #authentication-bypass | #php | #web-security | #saml | #xml-signature | #parser-discrepancies
Summary
Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
- Published
- Collected