---
id: 5034
title: "The Fragile Lock: Novel Bypasses For SAML Authentication"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/the-fragile-lock"
published_at: "2026-01-21 10:34"
tags: ["appsec", "ruby", "authentication-bypass", "php", "web-security", "saml", "xml-signature", "parser-discrepancies"]
phying_url: "https://phying.com/item/5034"
lang: en
---

# The Fragile Lock: Novel Bypasses For SAML Authentication

## Summary

Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2026-01-21 10:34
- **Original:** https://portswigger.net/research/the-fragile-lock
- **Phying News:** https://phying.com/item/5034