---
id: 5044
title: "SAML roulette: the hacker always wins"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/saml-roulette-the-hacker-always-wins"
published_at: "2025-03-31 07:10"
tags: ["gitlab", "authentication-bypass", "xml", "saml", "round-trip", "namespace-confusion"]
phying_url: "https://phying.com/item/5044"
lang: en
---

# SAML roulette: the hacker always wins

## Summary

Chaining XML round-trip attacks and namespace confusion yields unauthenticated admin access on GitLab Enterprise via ruby-saml, using comment and CDATA mutations that defeat signature verification.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2025-03-31 07:10
- **Original:** https://portswigger.net/research/saml-roulette-the-hacker-always-wins
- **Phying News:** https://phying.com/item/5044